Analysis
-
max time kernel
151s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
12-10-2022 09:57
Behavioral task
behavioral1
Sample
2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
Resource
win10v2004-20220812-en
General
-
Target
2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
-
Size
69KB
-
MD5
80372de850597bd9e7e021a94f13f0a1
-
SHA1
037db820c8dee94ae25a439b758a2b89f527cbb4
-
SHA256
2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8
-
SHA512
f43db3569ac60d6ed55b9a3a24dcb459e14b0bd944e9405a8cb2bfb686eaeff31c82ffcd6c477d6a6affe9014ae8ed7d8af174e8ceebbcf00b64ad293901a77a
-
SSDEEP
1536:juCWRxL7hbUiQfovecnXUU+hhOZuIWiFp+ZfaBZebC33O+Pd71vb:KCWf7VJQfmeMXvkhOZu1iFBBZebC3F7t
Malware Config
Extracted
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\C1AEB2-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Signatures
-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\CheckpointShow.tiff 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File renamed C:\Users\Admin\Pictures\ExitStart.tif => C:\Users\Admin\Pictures\ExitStart.tif.c1aeb2 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File renamed C:\Users\Admin\Pictures\PublishExit.crw => C:\Users\Admin\Pictures\PublishExit.crw.c1aeb2 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File renamed C:\Users\Admin\Pictures\FormatRevoke.raw => C:\Users\Admin\Pictures\FormatRevoke.raw.c1aeb2 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Users\Admin\Pictures\RestartSubmit.tiff 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File renamed C:\Users\Admin\Pictures\InitializeClear.crw => C:\Users\Admin\Pictures\InitializeClear.crw.c1aeb2 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File renamed C:\Users\Admin\Pictures\JoinShow.crw => C:\Users\Admin\Pictures\JoinShow.crw.c1aeb2 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File renamed C:\Users\Admin\Pictures\CheckpointShow.tiff => C:\Users\Admin\Pictures\CheckpointShow.tiff.c1aeb2 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File renamed C:\Users\Admin\Pictures\SkipOut.tif => C:\Users\Admin\Pictures\SkipOut.tif.c1aeb2 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File renamed C:\Users\Admin\Pictures\RestartSubmit.tiff => C:\Users\Admin\Pictures\RestartSubmit.tiff.c1aeb2 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exedescription ioc process File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\C1AEB2-Readme.txt 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCHDREST.CFG 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\MET 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\vlc.mo 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\C1AEB2-Readme.txt 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\TALK21.COM.XML 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File created C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\C1AEB2-Readme.txt 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\bbc_co_uk.luac 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143748.GIF 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GR8GALRY.GRA 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File created C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\C1AEB2-Readme.txt 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\vlc.mo 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\ACT3R.SAM 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\C1AEB2-Readme.txt 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10263_.GIF 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File created C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\C1AEB2-Readme.txt 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\lv.pak 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02055_.GIF 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02187_.GIF 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\vlc16x16.png 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File created C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\C1AEB2-Readme.txt 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files\Java\jre7\lib\management-agent.jar 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\PAWPRINT.GIF 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Black Tie.xml 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\DVA.api 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14514_.GIF 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeAUM_rootCert.cer 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\3082\MSO.ACL 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File created C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\C1AEB2-Readme.txt 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\C1AEB2-Readme.txt 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files\Java\jre7\lib\flavormap.properties 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaSansDemiBold.ttf 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Adak 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Foundry.xml 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File created C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\C1AEB2-Readme.txt 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Text.zip 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18218_.WMF 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File created C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\C1AEB2-Readme.txt 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.BR.XML 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files\ConfirmCompress.m1v 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files\LimitUnblock.rtf 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files\StartPing.ppt 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\OLADDR.FAE 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_GreenTea.gif 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\nacl_irt_x86_64.nexe 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Form.zip 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Dialog.zip 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Charitable Contributions.accdt 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File created C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\C1AEB2-Readme.txt 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+10 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\DATETIME.JPG 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\BOMB.WAV 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\VIEWBY.GIF 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1352 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exepid process 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exevssvc.exedescription pid process Token: SeDebugPrivilege 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe Token: SeImpersonatePrivilege 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe Token: SeBackupPrivilege 5036 vssvc.exe Token: SeRestorePrivilege 5036 vssvc.exe Token: SeAuditPrivilege 5036 vssvc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exedescription pid process target process PID 1872 wrote to memory of 1352 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe vssadmin.exe PID 1872 wrote to memory of 1352 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe vssadmin.exe PID 1872 wrote to memory of 1352 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe vssadmin.exe PID 1872 wrote to memory of 1352 1872 2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe"C:\Users\Admin\AppData\Local\Temp\2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken