Analysis
-
max time kernel
164s -
max time network
116s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
14-10-2022 13:00
Behavioral task
behavioral1
Sample
4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe
Resource
win10v2004-20220812-en
General
-
Target
4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe
-
Size
159KB
-
MD5
121ec45315b1cc9d73c9f44fad976694
-
SHA1
18f1fce2a63883d4eb5e796fc946094dbd948894
-
SHA256
4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6
-
SHA512
fa592d7c282d3e726197d6b9207f61fb0cef56e2a3534fbded16269d293af522bc0e93d8107137edb8ffe2ed2ff94357d824ca84c24c8b4c9d6f6696f071170e
-
SSDEEP
3072:vfCpcDozERHWkC1rd3CC5UB5KvSS0+9Pzo9p04/t9LU5Uht9e8A+BVfRbixpJ+L:vfCpc/RHcQC50e0QPCiEtVvthA7g
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\RECOVERY FILES.txt
https://twitter.com/mallox_leaks
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\HideRestore.tif => C:\Users\Admin\Pictures\HideRestore.tif.FARGO3 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Users\Admin\Pictures\MergeResolve.tiff 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File renamed C:\Users\Admin\Pictures\MergeResolve.tiff => C:\Users\Admin\Pictures\MergeResolve.tiff.FARGO3 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File renamed C:\Users\Admin\Pictures\SaveConvertFrom.crw => C:\Users\Admin\Pictures\SaveConvertFrom.crw.FARGO3 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File renamed C:\Users\Admin\Pictures\SendExpand.png => C:\Users\Admin\Pictures\SendExpand.png.FARGO3 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File renamed C:\Users\Admin\Pictures\SelectStart.raw => C:\Users\Admin\Pictures\SelectStart.raw.FARGO3 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File renamed C:\Users\Admin\Pictures\AssertSelect.crw => C:\Users\Admin\Pictures\AssertSelect.crw.FARGO3 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File renamed C:\Users\Admin\Pictures\ConnectPublish.raw => C:\Users\Admin\Pictures\ConnectPublish.raw.FARGO3 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Users\Admin\Pictures\ProtectEnter.tiff 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File renamed C:\Users\Admin\Pictures\ProtectEnter.tiff => C:\Users\Admin\Pictures\ProtectEnter.tiff.FARGO3 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe -
Stops running service(s) 3 TTPs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened (read-only) \??\E: 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened (read-only) \??\I: 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened (read-only) \??\M: 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened (read-only) \??\U: 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened (read-only) \??\V: 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened (read-only) \??\W: 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened (read-only) \??\Z: 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened (read-only) \??\B: 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened (read-only) \??\L: 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened (read-only) \??\P: 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened (read-only) \??\R: 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened (read-only) \??\Y: 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened (read-only) \??\H: 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened (read-only) \??\J: 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened (read-only) \??\K: 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened (read-only) \??\N: 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened (read-only) \??\O: 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened (read-only) \??\A: 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened (read-only) \??\F: 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened (read-only) \??\G: 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened (read-only) \??\Q: 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened (read-only) \??\S: 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened (read-only) \??\X: 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\RECOVERY FILES.txt 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\RECOVERY FILES.txt 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR4F.GIF 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL065.XML 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EquityMergeFax.Dotx 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_zh_CN.jar 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Dawson_Creek 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\CLNTWRAP.HTM 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\RECOVERY FILES.txt 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\RECOVERY FILES.txt 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uz\RECOVERY FILES.txt 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services_3.4.0.v20140312-2051.jar 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME05.CSS 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_OliveGreen.gif 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\jni_md.h 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\St_Johns 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File created C:\Program Files\VideoLAN\VLC\locale\oc\RECOVERY FILES.txt 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File created C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\RECOVERY FILES.txt 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PROOF\3082\RECOVERY FILES.txt 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02264_.WMF 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21535_.GIF 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\RECOVERY FILES.txt 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\RECOVERY FILES.txt 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART9.BDR 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files\Windows Journal\de-DE\RECOVERY FILES.txt 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105378.WMF 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0178348.JPG 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File created C:\Program Files\VideoLAN\VLC\locale\tr\RECOVERY FILES.txt 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+1 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files\Windows Journal\it-IT\PDIALOG.exe.mui 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\RECOVERY FILES.txt 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Author2XML.XSL 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEIRM.XML 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\RECOVERY FILES.txt 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152698.WMF 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTIRM.XML 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PULQOT98.POC 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\MANIFEST.MF 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaBrightRegular.ttf 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONENOTE_F_COL.HXK 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\RECOVERY FILES.txt 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File created C:\Program Files\VideoLAN\VLC\plugins\keystore\RECOVERY FILES.txt 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Khartoum 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qyzylorda 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\RECOVERY FILES.txt 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Aspect.eftx 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\RECOVERY FILES.txt 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\RECOVERY FILES.txt 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\RECOVERY FILES.txt 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB3B.BDR 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\OFFICE10.MML 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\MessageAttachmentIconImages.jpg 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\RECOVERY FILES.txt 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Angles.xml 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\RECOVERY FILES.txt 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152432.WMF 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309480.JPG 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1676 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1396 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1908 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1908 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe Token: SeDebugPrivilege 1908 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe Token: SeBackupPrivilege 1076 vssvc.exe Token: SeRestorePrivilege 1076 vssvc.exe Token: SeAuditPrivilege 1076 vssvc.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1908 wrote to memory of 1396 1908 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe 28 PID 1908 wrote to memory of 1396 1908 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe 28 PID 1908 wrote to memory of 1396 1908 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe 28 PID 1908 wrote to memory of 1396 1908 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe 28 PID 1908 wrote to memory of 1800 1908 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe 31 PID 1908 wrote to memory of 2036 1908 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe 33 PID 1908 wrote to memory of 2036 1908 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe 33 PID 1908 wrote to memory of 2036 1908 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe 33 PID 1908 wrote to memory of 2036 1908 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe 33 PID 1908 wrote to memory of 1800 1908 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe 31 PID 1908 wrote to memory of 1800 1908 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe 31 PID 1908 wrote to memory of 1800 1908 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe 31 PID 1908 wrote to memory of 316 1908 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe 35 PID 1908 wrote to memory of 316 1908 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe 35 PID 1908 wrote to memory of 316 1908 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe 35 PID 1908 wrote to memory of 316 1908 4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe 35 PID 2036 wrote to memory of 1676 2036 cmd.exe 37 PID 2036 wrote to memory of 1676 2036 cmd.exe 37 PID 2036 wrote to memory of 1676 2036 cmd.exe 37 PID 2036 wrote to memory of 1676 2036 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe"C:\Users\Admin\AppData\Local\Temp\4075d6e02c022ee45e0cd1c826abf749200639ee8ebc42375dac2430abafb5d6.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\system32\vssadmin.exe"C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:1396
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures2⤵PID:1800
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C sc delete MsDtsServer100&&sc delete MSSQL$SOPHOS&&sc delete MSSQLFDLauncher&&sc delete MSSQLSERVER&&sc delete MSSQLServerADHelper100&&sc delete MSSQLServerOLAPService&&sc delete ReportServer&&sc delete SQLAgent$SOPHOS&&sc delete "SQLANYs_sem5"&&sc delete SQLBrowser&&sc delete SQLSERVERAGENT&&sc delete SQLWriter&&sc delete B1LicenseService&&sc delete b1s50000&&sc delete b1s50001&&sc delete b1s50002&&sc delete B1ServerTools&&sc delete B1ServerTools64&&sc delete B1Workflow&&sc delete COMSysApp&&sc delete Gatekeeper64&&sc delete isapnp&&sc delete "SAP Business One RSP Agent Service"&&sc delete SBOClientAgent&&sc delete "SBODI_Server"&&sc delete SBOMail&&sc delete SBOWFDataAccess&&taskkill /f /im db*&&taskkill /f /im apache*&&taskkill /f /im mysql*&&taskkill /f /im Notifier*&&taskkill /f /im IBM*&&taskkill /f /im copy*&&taskkill /f /im store*&&taskkill /f /im sql*&&taskkill /f /im vee*&&taskkill /f /im wrsa*&&taskkill /f /im postg*&&taskkill /f /im sage*&&taskkill /f /im msdt*&&taskkill /f /im ora*&&taskkill /f /im microsoft*&&taskkill /f /im backup*&&taskkill /f /im http*&&taskkill /f /im office*&&taskkill /f /im cube*&&taskkill /f /im team*&&taskkill /f /im b1*&&taskkill /f /im sbo*&&taskkill /f /im reporting*&&taskkill /f /im sav*&&taskkill /f /im fd*&&taskkill /f /im microsoft*&&net stop MSSQLFDLauncher&&net stop MSSQLServerOLAPService&&net stop ReportServer2⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\sc.exesc delete MsDtsServer1003⤵
- Launches sc.exe
PID:1676
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no2⤵PID:316
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1076