Analysis
-
max time kernel
184s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
11-05-2022 23:12
Static task
static1
Behavioral task
behavioral1
Sample
ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe
-
Size
68KB
-
MD5
f269d24544e8bb4cb82680bb396a5f1b
-
SHA1
8283f4266a7782308b04a3d03c8b13a38eefaa61
-
SHA256
ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097
-
SHA512
c22f51697316c4d29e4b4ef817a1c73d4681fc02b0a2b0fee01e2aaf065d6a3aa04b7defc366cea012a723e600bd80a12083d54bb0907fa0b4cf6f12c41e68d1
Score
10/10
Malware Config
Signatures
-
Exorcist Ransomware
Ransomware-as-a-service which avoids infecting machines in CIS nations. First seen in mid-2020.
-
Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\RevokeDismount.tif => C:\Users\Admin\Pictures\RevokeDismount.tif.dSvcRD ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File created C:\Users\Admin\Pictures\RevokeDismount.tif.dSvcRDkey ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File opened for modification C:\Users\Admin\Pictures\StartTrace.crw.dSvcRD ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File renamed C:\Users\Admin\Pictures\RestoreSplit.raw => C:\Users\Admin\Pictures\RestoreSplit.raw.dSvcRD ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File opened for modification C:\Users\Admin\Pictures\RestoreSplit.raw.dSvcRD ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File renamed C:\Users\Admin\Pictures\StartTrace.crw => C:\Users\Admin\Pictures\StartTrace.crw.dSvcRD ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File created C:\Users\Admin\Pictures\StartTrace.crw.dSvcRDkey ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File created C:\Users\Admin\Pictures\RestoreSplit.raw.dSvcRDkey ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File opened for modification C:\Users\Admin\Pictures\RevokeDismount.tif.dSvcRD ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-18\desktop.ini ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File opened (read-only) \??\Z: ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File opened (read-only) \??\X: ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File opened (read-only) \??\R: ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File opened (read-only) \??\Q: ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File opened (read-only) \??\O: ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File opened (read-only) \??\N: ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File opened (read-only) \??\M: ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File opened (read-only) \??\H: ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File opened (read-only) \??\W: ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File opened (read-only) \??\V: ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File opened (read-only) \??\P: ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File opened (read-only) \??\L: ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File opened (read-only) \??\K: ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File opened (read-only) \??\D: ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File opened (read-only) \??\U: ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File opened (read-only) \??\I: ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File opened (read-only) \??\G: ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File opened (read-only) \??\F: ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File opened (read-only) \??\E: ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File opened (read-only) \??\Y: ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File opened (read-only) \??\T: ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File opened (read-only) \??\S: ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File opened (read-only) \??\B: ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File opened (read-only) \??\A: ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c007600630072006500640069007300740032003000320032005f007800360034005f003000300031005f0076006300520075006e00740069006d0065004100640064006900740069006f006e0061006c005f007800360034002e006c006f00670000000000 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004400650073006b0074006f0070005c0052006500730074006f007200650055006e0069006e007300740061006c006c002e0072006c00650000000000 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = c88aa610aa1a1a15389bbdae64840174badfd4544340ce5056cf50c01057b76e ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 5d089b1ab50804028392c8e29bf2a6acfdd4a650fe065016bee462098aa3bdd3 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 12cdd1ea6e6f9b300f6829888359c060315b77e270ddd65d233c8874594bd531 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = a30332ae0cfc8e431bc68457043b55cfc36bf7699b9472a19ac5ee40fc99aeb0 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = e1c638fe169c231769db45d71e849f6ecf16822b0b2745a23bc2eee21f110c0b ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 5bb7255be541dfe135dc455c973122e35bafd5b916e9a88e10d140d6b6649ea6 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 2b1a6515019e2560df1a63b927cfd152944ac4cb3a99b6a8df0047a80b74755d ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{edc211e1-0000-0000-0000-100000000000}\NukeOnDelete = "0" ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 721c8e4892b6967b684bed77acfda308bb65667c67631ac396311a6832d3f1e8 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = ee7e6608622b34d69f1cffba71ebdd5dbef77c194ada16dfe41800a74ea928b8 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c00500069006300740075007200650073005c0045007800700061006e0064004f007000740069006d0069007a0065002e0077006d00660000000000 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f0077006e006c006f006100640073005c0043006f006e006600690072006d0052006500730074006f00720065002e0078006d006c0000000000 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 6b8389e064cf28104774f92c12331fe1a02eb8996717aa53ca5efb75436728a9 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 29f550ec23cc2093ed6a5baa65faa34fe677b94d60164737c170b904acb413e7 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 1e05858a2e24549cb3defacaa36da01be6c457af7e5b8cc7f2e93069548de408 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f0077006e006c006f006100640073005c00520065006e0061006d00650043006f006e0076006500720074002e0065006d007a0000000000 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 4e05f4c399340f15779fb965e90cbfe282ed3651c4d0194405d92f61e79a03a6 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = cf6e0a2ac91f059cca4f3805f5cf9f188947a7d745ad93a75f28f170ceca135c ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = b06610159f32827c34e5b9738c20a145c15f653849f98a32def9fbab1fce6855 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c00500069006300740075007200650073005c004d006f0075006e00740054006500730074002e0065006d00660000000000 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 3e67f76f7c521d888f4dcdc62e845a45458e74676576e2d295d980e6703d3b56 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = a1cfa09bd33209a98b947d8682ee2e9df01113b04d6a09a73d35584f2d82acd1 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004d0075007300690063005c0053006500610072006300680052006500630065006900760065002e0063006f006e00740061006300740000000000 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c00500069006300740075007200650073005c0043006f006e007600650072007400440069007300610062006c0065002e0064007700670000000000 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004400650073006b0074006f0070005c0050006f0070005000750062006c006900730068002e0041004100430000000000 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 9768aada1de3f51b6510c9a9ffdeac07c1cadefd5f3bc69b8de9fe469e81e7e8 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 52904eb1c6284bd9b71071179de1cbfe9f7132f45843af59d0e38ec42789d5d1 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 52d0fd6e243ca26b730c27353c297718ba1a6882f64b79efd1c6178613f631c6 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = ec0a17349375e8af9c0fda89ff59cea67fae1b835f894205b44f352423aeffd7 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f00630075006d0065006e00740073005c00480069006400650055006e0062006c006f0063006b002e0078006c00610000000000 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = fca515c11c3fcaf1330ce9321ac518c439f9d95dd11141c4ca531dea91d4f987 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c007600630072006500640069007300740032003000310030005f007800360034002e006c006f0067002e00680074006d006c0000000000 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 3aa8b3549effc873bd0153f5a1876fa925844770ebd24f2c19d29c75a48eee6a ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 19141f5ead00a68e48542ab7e383589a7d1fd94349acc2da81a1695b9bea1a4f ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c007600630072006500640069007300740032003000310033005f007800360034005f003000300031005f0076006300520075006e00740069006d0065004100640064006900740069006f006e0061006c005f007800360034002e006c006f00670000000000 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = ec815bc31a4dd9f1735920590cc2b5aeb028faa92d490cf269a524a8bc3771b1 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f0077006e006c006f006100640073005c004e0065007700440065006e0079002e007a006900700000000000 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = fc495efab02cb6451328651b77c79aed170b9d245fc54060591868a887b1298a ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 0ffe05ff33b60187fc44becd8772a157e74e23493dc8bcab7382bacd00c6538c ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 9e76dea7bee1187bdcce81ff7cabf35bf17711c5e0b0f2da09cd795da17a46ea ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = fdb2b5261382497a20d2a5244d0bbb1c20809ec4fb7d22e868a3c72c2675cd24 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 6ef396a529d5607763641f33c9829ce989f36f6a9d9d9b802bf2680596bbd069 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 2db6a83c93b9186b7707e0f311923c768f75b671e4262c6a84f5cc5c7093c3d0 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 5255f2f2051e8440d1eab06d0c925c75c53ce235639d53f48c756d650e4e2611 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = e928e7439917b8e89fd7b4fec2a867a5f21ca2bb0a41a30c0235011df3d68528 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004400650073006b0074006f0070005c004100640064004d006500610073007500720065002e007800680074006d006c0000000000 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 0f3e15d4e8d40f3e0ddc426df786410e585138fd8fd3950d9888bd74d39edeb4 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = b7d90b85b2abc4670e78389d549fd2ee34d0cf5c36676d2d3aec257d8e9e2f4e ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = d7ee78c83d7c43770a1ae9fcc0c3b6db5404d1802cb87ff1fbd20f5669293e6f ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c00500069006300740075007200650073005c00500069006e00670053007400650070002e0070006300780000000000 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c002e006f007200610063006c0065005f006a00720065005f00750073006100670065005c003900300037003300370064003300320065003300610062006100340062002e00740069006d0065007300740061006d00700000000000 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = c2586a17b3b78daaf04598848c5065be0d6b1d9d6e1195d49957bdaf638bcf6c ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 3849b375bebc9c792667c35180186ab2a3844f6183fe81a7483d8771591ebd94 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = cbcaefde7612ae09829f44604426193220126a5adce6babca25d5b406f580b2c ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 27e50bac9695ded5bd8815420da1518b98caf972730d2b9ee41c8305fb2861ad ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 7167e8ea6d2baf38dd085f0a394a0b505cbce2756bcb7ee7990c7b139b46adcf ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 0aa2954b4618a55da70ec93753d7973e3c38f8817192c76f62784f46b024d8b6 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 2a86e6a6f3d31ce41a21547791999ec334858e576f0d5637bee717794880bc51 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004d0075007300690063005c00520065006e0061006d006500520065007300650074002e0072006100770000000000 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 83293ea79746f3fd2b6cb243a0faccfc607810e0c36b8bb8777c23afde4d050a ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{edc211e1-0000-0000-0000-d01200000000}\NukeOnDelete = "0" ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 0c44ca1fbd54cfc71d7da167efbfa839f030d53dd4a53b9d7bb2d772af514a4c ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe -
NTFS ADS 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\Microsoft\Windows\gjcKn3\windows.sys:lyhxozmopp ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File created C:\Users\Admin\AppData\Local\Temp\Microsoft\Windows\r15ft0\windows.sys:ymiuwsmgitpdtbmh ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File created C:\Users\Admin\AppData\Local\Temp\Microsoft\Windows\gjcKn3\windows.sys:lyhxozmopp ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe File created C:\Users\Admin\AppData\Local\Temp\Microsoft\Windows\CTpuQI\windows.sys:yoglygxpztqveikkj ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeDebugPrivilege 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Token: SeRestorePrivilege 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Token: SeDebugPrivilege 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Token: SeSecurityPrivilege 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Token: SeRestorePrivilege 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Token: SeDebugPrivilege 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe Token: SeIncreaseQuotaPrivilege 4528 WMIC.exe Token: SeSecurityPrivilege 4528 WMIC.exe Token: SeTakeOwnershipPrivilege 4528 WMIC.exe Token: SeLoadDriverPrivilege 4528 WMIC.exe Token: SeSystemProfilePrivilege 4528 WMIC.exe Token: SeSystemtimePrivilege 4528 WMIC.exe Token: SeProfSingleProcessPrivilege 4528 WMIC.exe Token: SeIncBasePriorityPrivilege 4528 WMIC.exe Token: SeCreatePagefilePrivilege 4528 WMIC.exe Token: SeBackupPrivilege 4528 WMIC.exe Token: SeRestorePrivilege 4528 WMIC.exe Token: SeShutdownPrivilege 4528 WMIC.exe Token: SeDebugPrivilege 4528 WMIC.exe Token: SeSystemEnvironmentPrivilege 4528 WMIC.exe Token: SeRemoteShutdownPrivilege 4528 WMIC.exe Token: SeUndockPrivilege 4528 WMIC.exe Token: SeManageVolumePrivilege 4528 WMIC.exe Token: 33 4528 WMIC.exe Token: 34 4528 WMIC.exe Token: 35 4528 WMIC.exe Token: 36 4528 WMIC.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3656 wrote to memory of 4832 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 80 PID 3656 wrote to memory of 4832 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 80 PID 3656 wrote to memory of 4832 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 80 PID 3656 wrote to memory of 5076 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 82 PID 3656 wrote to memory of 5076 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 82 PID 3656 wrote to memory of 5076 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 82 PID 3656 wrote to memory of 4836 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 84 PID 3656 wrote to memory of 4836 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 84 PID 3656 wrote to memory of 4836 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 84 PID 3656 wrote to memory of 3112 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 86 PID 3656 wrote to memory of 3112 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 86 PID 3656 wrote to memory of 3112 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 86 PID 3656 wrote to memory of 4276 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 88 PID 3656 wrote to memory of 4276 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 88 PID 3656 wrote to memory of 4276 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 88 PID 3656 wrote to memory of 3968 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 90 PID 3656 wrote to memory of 3968 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 90 PID 3656 wrote to memory of 3968 3656 ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe 90 PID 3968 wrote to memory of 4528 3968 cmd.exe 92 PID 3968 wrote to memory of 4528 3968 cmd.exe 92 PID 3968 wrote to memory of 4528 3968 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe"C:\Users\Admin\AppData\Local\Temp\ca680208fb28dca0595ca9f677c7845aca09c1979db0a9d680ad6f6bf30b7097.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Enumerates connected drives
- Modifies data under HKEY_USERS
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Windows\SysWOW64\cmd.execmd /C vssadmin Delete Shadows /All /Quiet2⤵PID:4832
-
-
C:\Windows\SysWOW64\cmd.execmd /C bcdedit /set {default} recoveryenabled No2⤵PID:5076
-
-
C:\Windows\SysWOW64\cmd.execmd /C bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵PID:4836
-
-
C:\Windows\SysWOW64\cmd.execmd /C wbadmin DELETE SYSTEMSTATEBACKUP2⤵PID:3112
-
-
C:\Windows\SysWOW64\cmd.execmd /C wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest2⤵PID:4276
-
-
C:\Windows\SysWOW64\cmd.execmd /C wmic SHADOWCOPY /nointeractive2⤵
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic SHADOWCOPY /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4528
-
-