Analysis
-
max time kernel
44s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12-05-2022 11:42
Static task
static1
Behavioral task
behavioral1
Sample
33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe
Resource
win10v2004-20220414-en
General
-
Target
33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe
-
Size
242KB
-
MD5
5f280e312f4b1e5b6ed2b6011bc81fd0
-
SHA1
4688cd7a7fa45cd4ba2fc7dd2cdb1e7bde05c8ad
-
SHA256
33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e
-
SHA512
a0f5f5da986f32c6c249770fdbe1e7d23ff737ef084b0c8cb6d6fdb3551e76f68cecb109f84020e5915531a003fbf997b86a89086caf2cecc7f64663ef36feda
Malware Config
Extracted
C:\Program Files\7-Zip\Restore-My-Files.txt
lockbit
http://lockbit-decryptor.top/?96B283EF5B7ACD4CE514760E6C76DD19
http://lockbitks2tvnmwk.onion/?96B283EF5B7ACD4CE514760E6C76DD19
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 2860 bcdedit.exe 2872 bcdedit.exe -
Processes:
wbadmin.exepid process 2884 wbadmin.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\XO1XADpO01 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe\"" 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
Processes:
33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exepid process 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe -
Drops file in Program Files directory 64 IoCs
Processes:
33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exedescription ioc process File opened for modification C:\Program Files\7-Zip\Lang\el.txt 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\it-IT\DVDMaker.exe.mui 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\Restore-My-Files.txt 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\it-IT\WMM2CLIP.dll.mui 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\button-highlight.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\blackbars60.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIcon.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\7-Zip\7z.sfx 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\fieldswitch.ax 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Restore-My-Files.txt 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File created C:\Program Files\7-Zip\Restore-My-Files.txt 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\audiodepthconverter.ax 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\Restore-My-Files.txt 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\performance.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\7-Zip\Lang\nn.txt 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2028 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exepid process 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exevssvc.exedescription pid process Token: SeTakeOwnershipPrivilege 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe Token: SeDebugPrivilege 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe Token: SeBackupPrivilege 1980 vssvc.exe Token: SeRestorePrivilege 1980 vssvc.exe Token: SeAuditPrivilege 1980 vssvc.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.execmd.exedescription pid process target process PID 872 wrote to memory of 1060 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe cmd.exe PID 872 wrote to memory of 1060 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe cmd.exe PID 872 wrote to memory of 1060 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe cmd.exe PID 872 wrote to memory of 1060 872 33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe cmd.exe PID 1060 wrote to memory of 2028 1060 cmd.exe vssadmin.exe PID 1060 wrote to memory of 2028 1060 cmd.exe vssadmin.exe PID 1060 wrote to memory of 2028 1060 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe"C:\Users\Admin\AppData\Local\Temp\33c05bb54f0fce069d75a4e13e90f0a130baff6e0d39d9782a3f467abd02803e.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet1⤵
- Interacts with shadow copies
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/872-55-0x00000000764C1000-0x00000000764C3000-memory.dmpFilesize
8KB
-
memory/872-59-0x00000000003A0000-0x00000000003C6000-memory.dmpFilesize
152KB
-
memory/872-58-0x0000000000230000-0x0000000000330000-memory.dmpFilesize
1024KB
-
memory/872-60-0x0000000000400000-0x0000000004DB8000-memory.dmpFilesize
73.7MB
-
memory/1060-56-0x0000000000000000-mapping.dmp
-
memory/2028-57-0x0000000000000000-mapping.dmp
-
memory/2772-61-0x0000000000000000-mapping.dmp
-
memory/2860-62-0x0000000000000000-mapping.dmp
-
memory/2872-63-0x0000000000000000-mapping.dmp
-
memory/2884-64-0x0000000000000000-mapping.dmp
-
memory/2884-65-0x000007FEFBD41000-0x000007FEFBD43000-memory.dmpFilesize
8KB