Analysis
-
max time kernel
151s -
max time network
175s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
26-06-2022 03:42
Static task
static1
Behavioral task
behavioral1
Sample
3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe
Resource
win10v2004-20220414-en
General
-
Target
3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe
-
Size
175KB
-
MD5
5fa8ad9d232314d906437a9bcaa4c66a
-
SHA1
e7e4a72fb5924051a41155044f03f55aaa304266
-
SHA256
3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d
-
SHA512
ea5827ace763562a502bd32c70df807c570f467eca5e79138bf7a66bb658049cfcd1d9b21e75e692c2a6d4b92e66636cd051138b223194921d1a8dfa061289c9
Malware Config
Extracted
C:\KRAB-DECRYPT.txt
http://gandcrabmfe6mnef.onion/fab57563577e6bc
Signatures
-
GandCrab Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1912-57-0x0000000000400000-0x0000000000430000-memory.dmp family_gandcrab -
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
suricata: ET MALWARE [eSentire] Win32/GandCrab v4/5 Ransomware CnC Activity
suricata: ET MALWARE [eSentire] Win32/GandCrab v4/5 Ransomware CnC Activity
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exedescription ioc process File renamed C:\Users\Admin\Pictures\PingSelect.raw => C:\Users\Admin\Pictures\PingSelect.raw.KRAB 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File renamed C:\Users\Admin\Pictures\TestUse.raw => C:\Users\Admin\Pictures\TestUse.raw.KRAB 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File renamed C:\Users\Admin\Pictures\ConfirmUnregister.png => C:\Users\Admin\Pictures\ConfirmUnregister.png.KRAB 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File renamed C:\Users\Admin\Pictures\EditPublish.raw => C:\Users\Admin\Pictures\EditPublish.raw.KRAB 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File renamed C:\Users\Admin\Pictures\JoinGrant.raw => C:\Users\Admin\Pictures\JoinGrant.raw.KRAB 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File renamed C:\Users\Admin\Pictures\LimitConvertFrom.raw => C:\Users\Admin\Pictures\LimitConvertFrom.raw.KRAB 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exedescription ioc process File opened (read-only) \??\K: 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened (read-only) \??\L: 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened (read-only) \??\M: 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened (read-only) \??\S: 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened (read-only) \??\E: 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened (read-only) \??\I: 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened (read-only) \??\J: 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened (read-only) \??\N: 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened (read-only) \??\P: 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened (read-only) \??\Q: 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened (read-only) \??\T: 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened (read-only) \??\V: 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened (read-only) \??\B: 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened (read-only) \??\G: 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened (read-only) \??\H: 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened (read-only) \??\Z: 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened (read-only) \??\W: 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened (read-only) \??\A: 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened (read-only) \??\O: 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened (read-only) \??\U: 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened (read-only) \??\Y: 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened (read-only) \??\F: 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened (read-only) \??\R: 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened (read-only) \??\X: 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe -
Drops file in Program Files directory 26 IoCs
Processes:
3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exedescription ioc process File opened for modification C:\Program Files\AddExport.potx 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened for modification C:\Program Files\ConvertToFormat.M2V 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened for modification C:\Program Files\SaveUnpublish.wdp 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened for modification C:\Program Files\ShowOpen.jpg 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File created C:\Program Files\KRAB-DECRYPT.txt 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File created C:\Program Files\3577e15f3577e6bc712.lock 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened for modification C:\Program Files\EnableExit.ADT 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened for modification C:\Program Files\ShowDebug.dib 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened for modification C:\Program Files\UnblockStart.i64 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened for modification C:\Program Files\UninstallUnlock.txt 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File created C:\Program Files (x86)\KRAB-DECRYPT.txt 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File created C:\Program Files (x86)\3577e15f3577e6bc712.lock 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened for modification C:\Program Files\BackupEnable.vbe 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened for modification C:\Program Files\ExitRepair.bmp 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened for modification C:\Program Files\NewUnregister.mht 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened for modification C:\Program Files\PopSplit.nfo 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened for modification C:\Program Files\ResetSelect.rar 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened for modification C:\Program Files\UndoDeny.xps 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\KRAB-DECRYPT.txt 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\3577e15f3577e6bc712.lock 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\KRAB-DECRYPT.txt 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\3577e15f3577e6bc712.lock 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened for modification C:\Program Files\CompareStop.wmv 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File opened for modification C:\Program Files\UnlockAdd.txt 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\3577e15f3577e6bc712.lock 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\KRAB-DECRYPT.txt 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe -
Processes:
3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exepid process 1912 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe 1912 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
Processes:
wmic.exevssvc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1572 wmic.exe Token: SeSecurityPrivilege 1572 wmic.exe Token: SeTakeOwnershipPrivilege 1572 wmic.exe Token: SeLoadDriverPrivilege 1572 wmic.exe Token: SeSystemProfilePrivilege 1572 wmic.exe Token: SeSystemtimePrivilege 1572 wmic.exe Token: SeProfSingleProcessPrivilege 1572 wmic.exe Token: SeIncBasePriorityPrivilege 1572 wmic.exe Token: SeCreatePagefilePrivilege 1572 wmic.exe Token: SeBackupPrivilege 1572 wmic.exe Token: SeRestorePrivilege 1572 wmic.exe Token: SeShutdownPrivilege 1572 wmic.exe Token: SeDebugPrivilege 1572 wmic.exe Token: SeSystemEnvironmentPrivilege 1572 wmic.exe Token: SeRemoteShutdownPrivilege 1572 wmic.exe Token: SeUndockPrivilege 1572 wmic.exe Token: SeManageVolumePrivilege 1572 wmic.exe Token: 33 1572 wmic.exe Token: 34 1572 wmic.exe Token: 35 1572 wmic.exe Token: SeIncreaseQuotaPrivilege 1572 wmic.exe Token: SeSecurityPrivilege 1572 wmic.exe Token: SeTakeOwnershipPrivilege 1572 wmic.exe Token: SeLoadDriverPrivilege 1572 wmic.exe Token: SeSystemProfilePrivilege 1572 wmic.exe Token: SeSystemtimePrivilege 1572 wmic.exe Token: SeProfSingleProcessPrivilege 1572 wmic.exe Token: SeIncBasePriorityPrivilege 1572 wmic.exe Token: SeCreatePagefilePrivilege 1572 wmic.exe Token: SeBackupPrivilege 1572 wmic.exe Token: SeRestorePrivilege 1572 wmic.exe Token: SeShutdownPrivilege 1572 wmic.exe Token: SeDebugPrivilege 1572 wmic.exe Token: SeSystemEnvironmentPrivilege 1572 wmic.exe Token: SeRemoteShutdownPrivilege 1572 wmic.exe Token: SeUndockPrivilege 1572 wmic.exe Token: SeManageVolumePrivilege 1572 wmic.exe Token: 33 1572 wmic.exe Token: 34 1572 wmic.exe Token: 35 1572 wmic.exe Token: SeBackupPrivilege 684 vssvc.exe Token: SeRestorePrivilege 684 vssvc.exe Token: SeAuditPrivilege 684 vssvc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exedescription pid process target process PID 1912 wrote to memory of 1572 1912 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe wmic.exe PID 1912 wrote to memory of 1572 1912 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe wmic.exe PID 1912 wrote to memory of 1572 1912 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe wmic.exe PID 1912 wrote to memory of 1572 1912 3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe wmic.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe"C:\Users\Admin\AppData\Local\Temp\3619fec40668b5c713499b9c451e428fb1c022bda4a24dd9fc3f62e0cc017b4d.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1572-59-0x0000000000000000-mapping.dmp
-
memory/1912-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmpFilesize
8KB
-
memory/1912-55-0x0000000000565000-0x0000000000577000-memory.dmpFilesize
72KB
-
memory/1912-57-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1912-56-0x000000000054E000-0x0000000000566000-memory.dmpFilesize
96KB
-
memory/1912-58-0x000000000054E000-0x0000000000566000-memory.dmpFilesize
96KB