2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8

General

Target

2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
Size

69KB
MD5

80372de850597bd9e7e021a94f13f0a1
SHA1

037db820c8dee94ae25a439b758a2b89f527cbb4
SHA256

2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8
SHA512

f43db3569ac60d6ed55b9a3a24dcb459e14b0bd944e9405a8cb2bfb686eaeff31c82ffcd6c477d6a6affe9014ae8ed7d8af174e8ceebbcf00b64ad293901a77a
SSDEEP

1536:juCWRxL7hbUiQfovecnXUU+hhOZuIWiFp+ZfaBZebC33O+Pd71vb:KCWf7VJQfmeMXvkhOZu1iFBBZebC3F7t

Score

9^/10

ransomware spyware stealer

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-48_altform-unplated_contrast-white_devicefamily-colorfulunplated.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\LargeLogo.scale-125_contrast-white.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\LargeTile.scale-125.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageWideTile.scale-200_contrast-black.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_BadgeLogo.scale-200.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-48_altform-unplated_contrast-black.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\HelpAndFeedback\BlogThumbnail.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.scale-100_contrast-black.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\RotateY.PNG	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql70.xsl	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-16_altform-unplated_contrast-black.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square310x310Logo.scale-125.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.scale-200.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Dtmf_4_Loud.m4a	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_contrast-black.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-16_contrast-black.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.scale-200.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\offsym.ttf	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-32_altform-unplated_contrast-black.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Notification_AppLogo_PowerStatus.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\README.txt	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-80_altform-unplated.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-36_altform-unplated_contrast-black.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TinyTile.scale-100_contrast-white.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MediumTile.scale-125_contrast-white.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe.sig	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreBadgeLogo.scale-100.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteSmallTile.scale-200.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-80.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\ormma.js	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Sybase.xsl	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-32_altform-unplated.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_SplashScreen.scale-100.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\LockScreenLogo.scale-200.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderLargeTile.contrast-black_scale-125.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\msedge_200_percent.pak.DATA	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubStoreLogo.scale-125_contrast-white.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_TileSmallSquare.scale-200.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteLargeTile.scale-400.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-60_altform-unplated.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SplashScreen.scale-100.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.scale-200.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\LibrarySquare150x150Logo.scale-125_contrast-white.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\AppxManifest.xml	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-48.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-150.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-72_altform-unplated.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupWideTile.scale-400.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionLargeTile.scale-100.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24_altform-unplated.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-32_altform-unplated.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalAppList.targetsize-72_altform-unplated_contrast-black.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Dtmf_2.m4a	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSplashLogo.scale-125.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\bootstrap.html	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-oob.xrm-ms	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\FileAssociation\FileAssociation.targetsize-256.png	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\40.jpg	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

520 vssadmin.exe

pid	process
520	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe

pid	process
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
Token: SeImpersonatePrivilege	1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
Token: SeBackupPrivilege	6428	vssvc.exe
Token: SeRestorePrivilege	6428	vssvc.exe
Token: SeAuditPrivilege	6428	vssvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe

description	pid	process	target process
PID 1444 wrote to memory of 520	1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe	vssadmin.exe
PID 1444 wrote to memory of 520	1444	2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe
"C:\Users\Admin\AppData\Local\Temp\2520b15068fa108c947db179377c6b462f2c4f47037168bf8c69fcb668cb11a8.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1444