Resubmissions
24-01-2023 13:50
230124-q5b1csca58 1024-01-2023 13:46
230124-q2y1qaca48 1024-11-2022 17:20
221124-vwk9wscd91 10Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 17:20
Behavioral task
behavioral1
Sample
f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe
Resource
win10v2004-20220901-en
General
-
Target
f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe
-
Size
2.9MB
-
MD5
df0b88dafe7a65295f99e69a67db9e1b
-
SHA1
db3163a09eb33ff4370ad162a05f4b2584a20456
-
SHA256
f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429
-
SHA512
2206969d222882dd8b7e3e5671311462266277d699e08e3016a7b3781b17390e8dd11956d8aaecae996a2c16227d7b2390eb84b9b8df26e39ffe8f38d5b76fbd
-
SSDEEP
49152:cDVwASOLGtlqrRIU6i9+vazNqQlJZP1BMU2thA8mNtNCiJlrRUFcJ7HIPcLzkw5c:wm+GaNqqJJ12vlZol8cJ7rc3
Malware Config
Extracted
C:\README.TXT
royal
http://royal2xthig3ou5hd7zsliqagy6yygk2cdelaxtni2fyad6dpmpxedid.onion/12344567890987654321234567890987
Signatures
-
Royal
Royal is a ransomware first seen in 2022.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exedescription ioc process File renamed C:\Users\Admin\Pictures\DisableNew.tif => C:\Users\Admin\Pictures\DisableNew.tif.royal f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File renamed C:\Users\Admin\Pictures\GrantAdd.png => C:\Users\Admin\Pictures\GrantAdd.png.royal f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File renamed C:\Users\Admin\Pictures\UpdateExport.png => C:\Users\Admin\Pictures\UpdateExport.png.royal f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File renamed C:\Users\Admin\Pictures\WatchInstall.crw => C:\Users\Admin\Pictures\WatchInstall.crw.royal f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe -
Drops startup file 1 IoCs
Processes:
f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\README.TXT f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe -
Drops desktop.ini file(s) 31 IoCs
Processes:
f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exedescription ioc process File opened for modification C:\Users\Admin\Downloads\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Users\Public\Libraries\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files (x86)\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Users\Public\Pictures\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Users\Public\Videos\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Users\Admin\Videos\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Users\Public\Documents\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Users\Public\Downloads\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Users\Public\Desktop\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Users\Public\Music\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Users\Public\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Users\Admin\Documents\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Users\Admin\Searches\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Users\Admin\Links\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Users\Admin\Music\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe -
Drops file in Program Files directory 64 IoCs
Processes:
f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exedescription ioc process File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\README.TXT f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\tr-tr\README.TXT f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL001.XML f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.properties f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-phn.xrm-ms f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\pt-br\README.TXT f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\ui-strings.js f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-oob.xrm-ms f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\README.TXT f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\cs_get.svg f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\example_icons2x.png f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-checkmark.png f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\README.TXT f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ppd.xrm-ms f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-il\README.TXT f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_zh_CN.jar f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7FR.LEX f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\ui-strings.js f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\js\README.TXT f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-ma\README.TXT f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\README.TXT f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sk-sk\README.TXT f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-keyring.jar f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\modules\host.luac f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\adobe_sign_tag_retina.png f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\de-de\ui-strings.js f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ppd.xrm-ms f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\README.TXT f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN108.XML f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_lg.gif f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\README.TXT f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\bn-IN.pak f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\s_agreement_filetype.svg f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File created C:\Program Files\Common Files\README.TXT f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File created C:\Program Files (x86)\MSBuild\Microsoft\README.TXT f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f4\README.TXT f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-pl.xrm-ms f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\README.TXT f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\[email protected] f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File created C:\Program Files\VideoLAN\VLC\locale\be\README.TXT f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.PNG f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\es-es\ui-strings.js f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\README.TXT f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ppd.xrm-ms f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-cn\README.TXT f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pt-br\README.TXT f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-oob.xrm-ms f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\config.xml f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\vlc.mo f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ppd.xrm-ms f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\README.TXT f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\ext\sunjce_provider.jar f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_ja.jar f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sendforsignature_18.svg f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\README.TXT f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\officemui.msi.16.en-us.boot.tree.dat f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\PSS10O.CHM f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_link_18.svg f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\msmdsrvi.rll f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 5044 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exepid process 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 3660 vssvc.exe Token: SeRestorePrivilege 3660 vssvc.exe Token: SeAuditPrivilege 3660 vssvc.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exedescription pid process target process PID 4180 wrote to memory of 5044 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe vssadmin.exe PID 4180 wrote to memory of 5044 4180 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exeC:\Users\Admin\AppData\Local\Temp\f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe -path C:\ -id 123445678909876543212345678909871⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\vssadmin.exedelete shadows /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5044-132-0x0000000000000000-mapping.dmp