Analysis
-
max time kernel
151s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-11-2022 15:21
Behavioral task
behavioral1
Sample
6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe
Resource
win7-20220812-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe
-
Size
669KB
-
MD5
87fc357cfaa43f6766a5efef072871bc
-
SHA1
ab77612d19ab9ec9f3bff9f13bf18cffc82799a7
-
SHA256
6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a
-
SHA512
2fbe4934c1d5485d12d4a395668778e765de66ec44afd06f8d702427dac7f8de13f4b3f954ef95f7f5cb27f6bc8f1db4933b56babfa6bab1575a66dfede5c436
-
SSDEEP
12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DhKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWIKrKe
Malware Config
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload 2 IoCs
resource yara_rule behavioral1/files/0x00140000000054ab-61.dat family_medusalocker behavioral1/files/0x00140000000054ab-63.dat family_medusalocker -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
pid Process 588 svhost.exe -
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\HideExpand.tiff 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened for modification C:\Users\Admin\Pictures\SyncSet.tiff 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File renamed C:\Users\Admin\Pictures\TestPublish.tif => C:\Users\Admin\Pictures\TestPublish.tif.netlock6 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File renamed C:\Users\Admin\Pictures\ExitReceive.png => C:\Users\Admin\Pictures\ExitReceive.png.netlock6 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File renamed C:\Users\Admin\Pictures\ExportComplete.png => C:\Users\Admin\Pictures\ExportComplete.png.netlock6 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File renamed C:\Users\Admin\Pictures\FindLock.png => C:\Users\Admin\Pictures\FindLock.png.netlock6 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File renamed C:\Users\Admin\Pictures\HideExpand.tiff => C:\Users\Admin\Pictures\HideExpand.tiff.netlock6 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File renamed C:\Users\Admin\Pictures\RepairReceive.tif => C:\Users\Admin\Pictures\RepairReceive.tif.netlock6 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File renamed C:\Users\Admin\Pictures\SyncSet.tiff => C:\Users\Admin\Pictures\SyncSet.tiff.netlock6 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File renamed C:\Users\Admin\Pictures\TestUnlock.crw => C:\Users\Admin\Pictures\TestUnlock.crw.netlock6 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File renamed C:\Users\Admin\Pictures\DisableWatch.raw => C:\Users\Admin\Pictures\DisableWatch.raw.netlock6 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File renamed C:\Users\Admin\Pictures\EnableClose.tif => C:\Users\Admin\Pictures\EnableClose.tif.netlock6 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-2292972927-2705560509-2768824231-1000\desktop.ini 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\Q: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\R: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\T: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\B: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\G: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\I: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\J: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\U: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\W: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\P: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\X: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\Y: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\Z: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\A: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\E: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\F: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\H: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\S: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\V: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\K: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\M: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\N: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\O: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1712 vssadmin.exe 1576 vssadmin.exe 1504 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeBackupPrivilege 1376 vssvc.exe Token: SeRestorePrivilege 1376 vssvc.exe Token: SeAuditPrivilege 1376 vssvc.exe Token: SeIncreaseQuotaPrivilege 2044 wmic.exe Token: SeSecurityPrivilege 2044 wmic.exe Token: SeTakeOwnershipPrivilege 2044 wmic.exe Token: SeLoadDriverPrivilege 2044 wmic.exe Token: SeSystemProfilePrivilege 2044 wmic.exe Token: SeSystemtimePrivilege 2044 wmic.exe Token: SeProfSingleProcessPrivilege 2044 wmic.exe Token: SeIncBasePriorityPrivilege 2044 wmic.exe Token: SeCreatePagefilePrivilege 2044 wmic.exe Token: SeBackupPrivilege 2044 wmic.exe Token: SeRestorePrivilege 2044 wmic.exe Token: SeShutdownPrivilege 2044 wmic.exe Token: SeDebugPrivilege 2044 wmic.exe Token: SeSystemEnvironmentPrivilege 2044 wmic.exe Token: SeRemoteShutdownPrivilege 2044 wmic.exe Token: SeUndockPrivilege 2044 wmic.exe Token: SeManageVolumePrivilege 2044 wmic.exe Token: 33 2044 wmic.exe Token: 34 2044 wmic.exe Token: 35 2044 wmic.exe Token: SeIncreaseQuotaPrivilege 1520 wmic.exe Token: SeSecurityPrivilege 1520 wmic.exe Token: SeTakeOwnershipPrivilege 1520 wmic.exe Token: SeLoadDriverPrivilege 1520 wmic.exe Token: SeSystemProfilePrivilege 1520 wmic.exe Token: SeSystemtimePrivilege 1520 wmic.exe Token: SeProfSingleProcessPrivilege 1520 wmic.exe Token: SeIncBasePriorityPrivilege 1520 wmic.exe Token: SeCreatePagefilePrivilege 1520 wmic.exe Token: SeBackupPrivilege 1520 wmic.exe Token: SeRestorePrivilege 1520 wmic.exe Token: SeShutdownPrivilege 1520 wmic.exe Token: SeDebugPrivilege 1520 wmic.exe Token: SeSystemEnvironmentPrivilege 1520 wmic.exe Token: SeRemoteShutdownPrivilege 1520 wmic.exe Token: SeUndockPrivilege 1520 wmic.exe Token: SeManageVolumePrivilege 1520 wmic.exe Token: 33 1520 wmic.exe Token: 34 1520 wmic.exe Token: 35 1520 wmic.exe Token: SeIncreaseQuotaPrivilege 1436 wmic.exe Token: SeSecurityPrivilege 1436 wmic.exe Token: SeTakeOwnershipPrivilege 1436 wmic.exe Token: SeLoadDriverPrivilege 1436 wmic.exe Token: SeSystemProfilePrivilege 1436 wmic.exe Token: SeSystemtimePrivilege 1436 wmic.exe Token: SeProfSingleProcessPrivilege 1436 wmic.exe Token: SeIncBasePriorityPrivilege 1436 wmic.exe Token: SeCreatePagefilePrivilege 1436 wmic.exe Token: SeBackupPrivilege 1436 wmic.exe Token: SeRestorePrivilege 1436 wmic.exe Token: SeShutdownPrivilege 1436 wmic.exe Token: SeDebugPrivilege 1436 wmic.exe Token: SeSystemEnvironmentPrivilege 1436 wmic.exe Token: SeRemoteShutdownPrivilege 1436 wmic.exe Token: SeUndockPrivilege 1436 wmic.exe Token: SeManageVolumePrivilege 1436 wmic.exe Token: 33 1436 wmic.exe Token: 34 1436 wmic.exe Token: 35 1436 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1088 wrote to memory of 1504 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 27 PID 1088 wrote to memory of 1504 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 27 PID 1088 wrote to memory of 1504 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 27 PID 1088 wrote to memory of 1504 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 27 PID 1088 wrote to memory of 2044 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 30 PID 1088 wrote to memory of 2044 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 30 PID 1088 wrote to memory of 2044 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 30 PID 1088 wrote to memory of 2044 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 30 PID 1088 wrote to memory of 1712 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 32 PID 1088 wrote to memory of 1712 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 32 PID 1088 wrote to memory of 1712 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 32 PID 1088 wrote to memory of 1712 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 32 PID 1088 wrote to memory of 1520 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 34 PID 1088 wrote to memory of 1520 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 34 PID 1088 wrote to memory of 1520 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 34 PID 1088 wrote to memory of 1520 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 34 PID 1088 wrote to memory of 1576 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 36 PID 1088 wrote to memory of 1576 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 36 PID 1088 wrote to memory of 1576 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 36 PID 1088 wrote to memory of 1576 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 36 PID 1088 wrote to memory of 1436 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 38 PID 1088 wrote to memory of 1436 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 38 PID 1088 wrote to memory of 1436 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 38 PID 1088 wrote to memory of 1436 1088 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 38 PID 1608 wrote to memory of 588 1608 taskeng.exe 43 PID 1608 wrote to memory of 588 1608 taskeng.exe 43 PID 1608 wrote to memory of 588 1608 taskeng.exe 43 PID 1608 wrote to memory of 588 1608 taskeng.exe 43 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe"C:\Users\Admin\AppData\Local\Temp\6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe"1⤵
- UAC bypass
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1088 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1504
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2044
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1712
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1520
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1576
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1436
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1376
-
C:\Windows\system32\taskeng.exetaskeng.exe {E6663A06-7F3C-4614-8573-9759E44628E7} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe2⤵
- Executes dropped EXE
PID:588
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
669KB
MD587fc357cfaa43f6766a5efef072871bc
SHA1ab77612d19ab9ec9f3bff9f13bf18cffc82799a7
SHA2566cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a
SHA5122fbe4934c1d5485d12d4a395668778e765de66ec44afd06f8d702427dac7f8de13f4b3f954ef95f7f5cb27f6bc8f1db4933b56babfa6bab1575a66dfede5c436
-
Filesize
669KB
MD587fc357cfaa43f6766a5efef072871bc
SHA1ab77612d19ab9ec9f3bff9f13bf18cffc82799a7
SHA2566cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a
SHA5122fbe4934c1d5485d12d4a395668778e765de66ec44afd06f8d702427dac7f8de13f4b3f954ef95f7f5cb27f6bc8f1db4933b56babfa6bab1575a66dfede5c436