9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9

General

Target

9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
Size

21KB
MD5

ef8fe9e54b324a7b8c52dd55970c3eee
SHA1

08c2d71489f6e203d9281904e933a797d5822463
SHA256

9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9
SHA512

a0ed1ff57f275c58626de37a1709957d46e4199bd113e98b405026456d45af8bc658724d185a88614a6cd5fa3092e32ae89a9400de6ca6a4713cdbb90ea21132
SSDEEP

384:7rwgu4oJuTJj+XZ9Y9qkyUI07jn6qq9fUaIfqfxWkqxrF6ZlvH38R0V:HaJU+Je9Lwjn9fU7q55AQDHr

Score

10^/10

evasion persistence ransomware upx

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

svchost.exe

description pid process target process

PID 4776 created 2284 4776 svchost.exe 9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

2096 bcdedit.exe
4076 bcdedit.exe
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command-Line Interface
T1059

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

204 wbadmin.exe

description	pid	process	target process
PID 4776 created 2284	4776	svchost.exe	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe

pid	process
2096	bcdedit.exe
4076	bcdedit.exe

pid	process
204	wbadmin.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2284-132-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4960-134-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4960-137-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4960-143-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe\""	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe

Drops desktop.ini file(s) 3 IoCs

Processes:

9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe

description	ioc	process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2629973501-4017243118-3254762364-1000\desktop.ini	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\desktop.ini	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe

Drops file in Program Files directory 64 IoCs

Processes:

9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-oob.xrm-ms	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.VisualElementsManifest.xml	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\README-JDK.html	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaBrightItalic.ttf	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ul-oob.xrm-ms	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ppd.xrm-ms	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-pl.xrm-ms	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\java.dll	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-pl.xrm-ms	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\MSO.ACL	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicsimple.dotx	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\vccorlib140.dll	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-core-execution.xml	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-progress-ui.xml	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Gallery.thmx	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ul-oob.xrm-ms	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\xmsrv.dll	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\bin\startNetworkServer.bat	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup-impl.xml	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\tzmappings	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag-dark@3x.png	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\javaws.policy	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-core-kit.xml	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\vccorlib140.dll	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OSF.DLL	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_zh_CN.jar	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\ext\access-bridge-64.jar	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ul-oob.xrm-ms	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core.jar	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ppd.xrm-ms	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-pl.xrm-ms	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXT	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\sqlpdw.xsl	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\concrt140.dll	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\THMBNAIL.PNG	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-oob.xrm-ms	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ppd.xrm-ms	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.AddinTelemetry.dll	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\msipc.dll.mui	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\content-types.properties	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-pl.xrm-ms	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ppd.xrm-ms	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ppd.xrm-ms	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ul-oob.xrm-ms	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\THMBNAIL.PNG	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-pl.xrm-ms	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ppd.xrm-ms	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vds.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

3476 vssadmin.exe

pid	process
3476	vssadmin.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

Processes:

svchost.exevssvc.exeWMIC.exewbengine.exe

description	pid	process
Token: SeTcbPrivilege	4776	svchost.exe
Token: SeTcbPrivilege	4776	svchost.exe
Token: SeBackupPrivilege	1984	vssvc.exe
Token: SeRestorePrivilege	1984	vssvc.exe
Token: SeAuditPrivilege	1984	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4240	WMIC.exe
Token: SeSecurityPrivilege	4240	WMIC.exe
Token: SeTakeOwnershipPrivilege	4240	WMIC.exe
Token: SeLoadDriverPrivilege	4240	WMIC.exe
Token: SeSystemProfilePrivilege	4240	WMIC.exe
Token: SeSystemtimePrivilege	4240	WMIC.exe
Token: SeProfSingleProcessPrivilege	4240	WMIC.exe
Token: SeIncBasePriorityPrivilege	4240	WMIC.exe
Token: SeCreatePagefilePrivilege	4240	WMIC.exe
Token: SeBackupPrivilege	4240	WMIC.exe
Token: SeRestorePrivilege	4240	WMIC.exe
Token: SeShutdownPrivilege	4240	WMIC.exe
Token: SeDebugPrivilege	4240	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4240	WMIC.exe
Token: SeRemoteShutdownPrivilege	4240	WMIC.exe
Token: SeUndockPrivilege	4240	WMIC.exe
Token: SeManageVolumePrivilege	4240	WMIC.exe
Token: 33	4240	WMIC.exe
Token: 34	4240	WMIC.exe
Token: 35	4240	WMIC.exe
Token: 36	4240	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4240	WMIC.exe
Token: SeSecurityPrivilege	4240	WMIC.exe
Token: SeTakeOwnershipPrivilege	4240	WMIC.exe
Token: SeLoadDriverPrivilege	4240	WMIC.exe
Token: SeSystemProfilePrivilege	4240	WMIC.exe
Token: SeSystemtimePrivilege	4240	WMIC.exe
Token: SeProfSingleProcessPrivilege	4240	WMIC.exe
Token: SeIncBasePriorityPrivilege	4240	WMIC.exe
Token: SeCreatePagefilePrivilege	4240	WMIC.exe
Token: SeBackupPrivilege	4240	WMIC.exe
Token: SeRestorePrivilege	4240	WMIC.exe
Token: SeShutdownPrivilege	4240	WMIC.exe
Token: SeDebugPrivilege	4240	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4240	WMIC.exe
Token: SeRemoteShutdownPrivilege	4240	WMIC.exe
Token: SeUndockPrivilege	4240	WMIC.exe
Token: SeManageVolumePrivilege	4240	WMIC.exe
Token: 33	4240	WMIC.exe
Token: 34	4240	WMIC.exe
Token: 35	4240	WMIC.exe
Token: 36	4240	WMIC.exe
Token: SeBackupPrivilege	3148	wbengine.exe
Token: SeRestorePrivilege	3148	wbengine.exe
Token: SeSecurityPrivilege	3148	wbengine.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

svchost.exe9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.execmd.exe

description	pid	process	target process
PID 4776 wrote to memory of 4960	4776	svchost.exe	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
PID 4776 wrote to memory of 4960	4776	svchost.exe	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
PID 4776 wrote to memory of 4960	4776	svchost.exe	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
PID 4776 wrote to memory of 4960	4776	svchost.exe	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
PID 4776 wrote to memory of 4960	4776	svchost.exe	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
PID 4776 wrote to memory of 4960	4776	svchost.exe	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
PID 4776 wrote to memory of 4960	4776	svchost.exe	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
PID 2284 wrote to memory of 3708	2284	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe	cmd.exe
PID 2284 wrote to memory of 3708	2284	9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe	cmd.exe
PID 3708 wrote to memory of 3476	3708	cmd.exe	vssadmin.exe
PID 3708 wrote to memory of 3476	3708	cmd.exe	vssadmin.exe
PID 3708 wrote to memory of 4240	3708	cmd.exe	WMIC.exe
PID 3708 wrote to memory of 4240	3708	cmd.exe	WMIC.exe
PID 3708 wrote to memory of 2096	3708	cmd.exe	bcdedit.exe
PID 3708 wrote to memory of 2096	3708	cmd.exe	bcdedit.exe
PID 3708 wrote to memory of 4076	3708	cmd.exe	bcdedit.exe
PID 3708 wrote to memory of 4076	3708	cmd.exe	bcdedit.exe
PID 3708 wrote to memory of 204	3708	cmd.exe	wbadmin.exe
PID 3708 wrote to memory of 204	3708	cmd.exe	wbadmin.exe

C:\Users\Admin\AppData\Local\Temp\9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
"C:\Users\Admin\AppData\Local\Temp\9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2284

C:\Users\Admin\AppData\Local\Temp\9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe
"C:\Users\Admin\AppData\Local\Temp\9385c94181cda268839695c6b7adf6afd3218a44be5e31fa11eac8cee54f6db9.exe" n2284
2⤵
PID:4960

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3708

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:3476

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4240

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
3⤵
- Modifies boot configuration data using bcdedit
PID:2096

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
3⤵
- Modifies boot configuration data using bcdedit
PID:4076

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
3⤵
- Deletes backup catalog
PID:204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1984

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3148

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2152

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:1048

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

3

T1107

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

4

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2629973501-4017243118-3254762364-1000\desktop.ini
Filesize
356B

MD5
f1f6b62c714beca3ee88184e4e596e1d

SHA1
c53648c4656dc5254db09e58a64f3a284a8844bb

SHA256
a903f45002cc402ad9c78730e2020d879ca663f0570cfd449904938087991cf1

SHA512
24253e415bc07e63f3e119460449f7ac7a76fb57c6cb8243032064caea9e9fa3f852cd486eaed091e4e13bc9a496270555cb8430e0e815331d109daef04bcbf7

Download Submit
memory/204-141-0x0000000000000000-mapping.dmp

Download
memory/2096-139-0x0000000000000000-mapping.dmp

Download
memory/2284-132-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3476-136-0x0000000000000000-mapping.dmp

Download
memory/3708-135-0x0000000000000000-mapping.dmp

Download
memory/4076-140-0x0000000000000000-mapping.dmp

Download
memory/4240-138-0x0000000000000000-mapping.dmp

Download
memory/4960-133-0x0000000000000000-mapping.dmp

Download
memory/4960-134-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4960-137-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4960-143-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads