Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
10-11-2022 07:01
Behavioral task
behavioral1
Sample
b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe
Resource
win7-20220812-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe
-
Size
669KB
-
MD5
ac546514c037b432430bebc8e3884dad
-
SHA1
f4e2e0eea53546e9a2b1cf136eb8a5ce7015f06d
-
SHA256
b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009
-
SHA512
b4f703141e1fc471df35e968977535e4b64cddebc9bba66037b259265234ed254249d9b451f0856cc902919cce77062c6242d49752dcd5e488f7c3d486bc5d99
-
SSDEEP
12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DXKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWCKrKe
Malware Config
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload 2 IoCs
resource yara_rule behavioral1/files/0x000c0000000054a8-61.dat family_medusalocker behavioral1/files/0x000c0000000054a8-63.dat family_medusalocker -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
pid Process 1508 svhost.exe -
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\MergeReset.crw => C:\Users\Admin\Pictures\MergeReset.crw.netlock12 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File renamed C:\Users\Admin\Pictures\ProtectEnable.png => C:\Users\Admin\Pictures\ProtectEnable.png.netlock12 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File renamed C:\Users\Admin\Pictures\SetMove.png => C:\Users\Admin\Pictures\SetMove.png.netlock12 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File renamed C:\Users\Admin\Pictures\SkipBackup.tif => C:\Users\Admin\Pictures\SkipBackup.tif.netlock12 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File renamed C:\Users\Admin\Pictures\CopyCheckpoint.raw => C:\Users\Admin\Pictures\CopyCheckpoint.raw.netlock12 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File renamed C:\Users\Admin\Pictures\DenyAssert.crw => C:\Users\Admin\Pictures\DenyAssert.crw.netlock12 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File renamed C:\Users\Admin\Pictures\ExpandImport.crw => C:\Users\Admin\Pictures\ExpandImport.crw.netlock12 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File renamed C:\Users\Admin\Pictures\ExportUnblock.png => C:\Users\Admin\Pictures\ExportUnblock.png.netlock12 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-3845472200-3839195424-595303356-1000\desktop.ini b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\I: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\O: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\W: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\S: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\Y: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\A: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\G: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\N: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\P: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\Z: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\H: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\K: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\T: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\V: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\M: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\Q: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\R: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\U: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\B: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\E: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\J: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\L: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe File opened (read-only) \??\X: b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1488 vssadmin.exe 1740 vssadmin.exe 1624 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeBackupPrivilege 1956 vssvc.exe Token: SeRestorePrivilege 1956 vssvc.exe Token: SeAuditPrivilege 1956 vssvc.exe Token: SeIncreaseQuotaPrivilege 560 wmic.exe Token: SeSecurityPrivilege 560 wmic.exe Token: SeTakeOwnershipPrivilege 560 wmic.exe Token: SeLoadDriverPrivilege 560 wmic.exe Token: SeSystemProfilePrivilege 560 wmic.exe Token: SeSystemtimePrivilege 560 wmic.exe Token: SeProfSingleProcessPrivilege 560 wmic.exe Token: SeIncBasePriorityPrivilege 560 wmic.exe Token: SeCreatePagefilePrivilege 560 wmic.exe Token: SeBackupPrivilege 560 wmic.exe Token: SeRestorePrivilege 560 wmic.exe Token: SeShutdownPrivilege 560 wmic.exe Token: SeDebugPrivilege 560 wmic.exe Token: SeSystemEnvironmentPrivilege 560 wmic.exe Token: SeRemoteShutdownPrivilege 560 wmic.exe Token: SeUndockPrivilege 560 wmic.exe Token: SeManageVolumePrivilege 560 wmic.exe Token: 33 560 wmic.exe Token: 34 560 wmic.exe Token: 35 560 wmic.exe Token: SeIncreaseQuotaPrivilege 1628 wmic.exe Token: SeSecurityPrivilege 1628 wmic.exe Token: SeTakeOwnershipPrivilege 1628 wmic.exe Token: SeLoadDriverPrivilege 1628 wmic.exe Token: SeSystemProfilePrivilege 1628 wmic.exe Token: SeSystemtimePrivilege 1628 wmic.exe Token: SeProfSingleProcessPrivilege 1628 wmic.exe Token: SeIncBasePriorityPrivilege 1628 wmic.exe Token: SeCreatePagefilePrivilege 1628 wmic.exe Token: SeBackupPrivilege 1628 wmic.exe Token: SeRestorePrivilege 1628 wmic.exe Token: SeShutdownPrivilege 1628 wmic.exe Token: SeDebugPrivilege 1628 wmic.exe Token: SeSystemEnvironmentPrivilege 1628 wmic.exe Token: SeRemoteShutdownPrivilege 1628 wmic.exe Token: SeUndockPrivilege 1628 wmic.exe Token: SeManageVolumePrivilege 1628 wmic.exe Token: 33 1628 wmic.exe Token: 34 1628 wmic.exe Token: 35 1628 wmic.exe Token: SeIncreaseQuotaPrivilege 776 wmic.exe Token: SeSecurityPrivilege 776 wmic.exe Token: SeTakeOwnershipPrivilege 776 wmic.exe Token: SeLoadDriverPrivilege 776 wmic.exe Token: SeSystemProfilePrivilege 776 wmic.exe Token: SeSystemtimePrivilege 776 wmic.exe Token: SeProfSingleProcessPrivilege 776 wmic.exe Token: SeIncBasePriorityPrivilege 776 wmic.exe Token: SeCreatePagefilePrivilege 776 wmic.exe Token: SeBackupPrivilege 776 wmic.exe Token: SeRestorePrivilege 776 wmic.exe Token: SeShutdownPrivilege 776 wmic.exe Token: SeDebugPrivilege 776 wmic.exe Token: SeSystemEnvironmentPrivilege 776 wmic.exe Token: SeRemoteShutdownPrivilege 776 wmic.exe Token: SeUndockPrivilege 776 wmic.exe Token: SeManageVolumePrivilege 776 wmic.exe Token: 33 776 wmic.exe Token: 34 776 wmic.exe Token: 35 776 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1832 wrote to memory of 1624 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 27 PID 1832 wrote to memory of 1624 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 27 PID 1832 wrote to memory of 1624 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 27 PID 1832 wrote to memory of 1624 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 27 PID 1832 wrote to memory of 560 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 31 PID 1832 wrote to memory of 560 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 31 PID 1832 wrote to memory of 560 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 31 PID 1832 wrote to memory of 560 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 31 PID 1832 wrote to memory of 1488 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 33 PID 1832 wrote to memory of 1488 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 33 PID 1832 wrote to memory of 1488 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 33 PID 1832 wrote to memory of 1488 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 33 PID 1832 wrote to memory of 1628 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 35 PID 1832 wrote to memory of 1628 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 35 PID 1832 wrote to memory of 1628 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 35 PID 1832 wrote to memory of 1628 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 35 PID 1832 wrote to memory of 1740 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 37 PID 1832 wrote to memory of 1740 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 37 PID 1832 wrote to memory of 1740 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 37 PID 1832 wrote to memory of 1740 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 37 PID 1832 wrote to memory of 776 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 39 PID 1832 wrote to memory of 776 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 39 PID 1832 wrote to memory of 776 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 39 PID 1832 wrote to memory of 776 1832 b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe 39 PID 940 wrote to memory of 1508 940 taskeng.exe 44 PID 940 wrote to memory of 1508 940 taskeng.exe 44 PID 940 wrote to memory of 1508 940 taskeng.exe 44 PID 940 wrote to memory of 1508 940 taskeng.exe 44 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe"C:\Users\Admin\AppData\Local\Temp\b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009.exe"1⤵
- UAC bypass
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1832 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1624
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:560
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1488
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1628
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1740
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:776
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1956
-
C:\Windows\system32\taskeng.exetaskeng.exe {A743B491-7BF3-4D1F-B57D-DB710608AF55} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe2⤵
- Executes dropped EXE
PID:1508
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
669KB
MD5ac546514c037b432430bebc8e3884dad
SHA1f4e2e0eea53546e9a2b1cf136eb8a5ce7015f06d
SHA256b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009
SHA512b4f703141e1fc471df35e968977535e4b64cddebc9bba66037b259265234ed254249d9b451f0856cc902919cce77062c6242d49752dcd5e488f7c3d486bc5d99
-
Filesize
669KB
MD5ac546514c037b432430bebc8e3884dad
SHA1f4e2e0eea53546e9a2b1cf136eb8a5ce7015f06d
SHA256b00be4dda45f8670b0e65d37cc7770fa791d869c7e567ea316d84d16283f8009
SHA512b4f703141e1fc471df35e968977535e4b64cddebc9bba66037b259265234ed254249d9b451f0856cc902919cce77062c6242d49752dcd5e488f7c3d486bc5d99