Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
295s -
max time network
100s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/12/2022, 03:44
Static task
static1
Behavioral task
behavioral1
Sample
0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe
Resource
win10v2004-20220812-en
General
-
Target
0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe
-
Size
959KB
-
MD5
1c4bb14ba990b670d74489cbf7566333
-
SHA1
29835566ba50053ea892f7729bb9f63cea0d21ce
-
SHA256
0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1
-
SHA512
8e61c2179c95dd3459aa9b880ab93263eed9b5fe8b1d6f47fa7489cba8043cbf2aca1b58777020cf59f0f10c8632a1fe7cae1cedb7e11a2c2782bf484df1db3d
-
SSDEEP
24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdpF:Ujrc2So1Ff+B3k796v
Malware Config
Extracted
C:\program files\7-zip\Restore-My-Files.txt
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
https://bigblog.at
http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
https://decoding.at
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2300 bcdedit.exe 2600 bcdedit.exe -
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\users\admin\pictures\hidestep.tiff 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File renamed C:\Users\Admin\Pictures\AddClose.raw => C:\users\admin\pictures\addclose.raw.lockbit 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File renamed C:\Users\Admin\Pictures\NewGet.png => C:\users\admin\pictures\newget.png.lockbit 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File renamed C:\Users\Admin\Pictures\SyncRestart.tif => C:\users\admin\pictures\syncrestart.tif.lockbit 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File renamed C:\Users\Admin\Pictures\HideStep.tiff => C:\users\admin\pictures\hidestep.tiff.lockbit 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\users\admin\pictures\clearconvertto.tiff 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\users\admin\pictures\denyimport.tiff 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File renamed C:\Users\Admin\Pictures\ClearConvertTo.tiff => C:\users\admin\pictures\clearconvertto.tiff.lockbit 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File renamed C:\Users\Admin\Pictures\RegisterMerge.png => C:\users\admin\pictures\registermerge.png.lockbit 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File renamed C:\Users\Admin\Pictures\DenyImport.tiff => C:\users\admin\pictures\denyimport.tiff.lockbit 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\{D0202F97-7979-48E2-F34C-F370E2755A1C} = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe\"" 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\windows\SysWOW64\D220E4.ico 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 21 IoCs
pid Process 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\program files\startredo.aiff 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\commondata\alertimage_offmask.bmp 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\office14\outlookautodiscover\yahoo.com.sg.xml 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\office14\pubwiz\flyer11.poc 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_ja_4.4.0.v20140623020002.jar 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files\java\jre7\lib\zi\australia\eucla 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\bs00445_.wmf 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\clipart\publisher\backgrounds\wb02134_.gif 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files\7-zip\lang\io.txt 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files\videolan\vlc\locale\zh_tw\lc_messages\vlc.mo 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0152898.wmf 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\ph01478u.bmp 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File created C:\program files\videolan\vlc\locale\brx\lc_messages\Restore-My-Files.txt 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files\windows sidebar\gadgets\clock.gadget\images\settings_box_top.png 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files\java\jre7\lib\zi\asia\pontianak 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files\microsoft games\more games\es-es\moregames.dll.mui 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\fd00459_.wmf 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\office14\1033\grooveforms5\formsstyles\sts2.css 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File created C:\program files (x86)\microsoft office\office14\groove\certificates\groove.net\components\Restore-My-Files.txt 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\currency.gadget\images\delete_up.png 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-impl.xml 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvmstat.xml 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\wb01744_.gif 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\office14\1033\infopatheditor_k_col.hxk 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\office14\1033\ois_col.hxc 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File created C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\computers\Restore-My-Files.txt 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\cpu.gadget\es-es\gadget.xml 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\config\modules\org-openide-windows.xml 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files\java\jre7\lib\zi\australia\lindeman 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\pe00898_.wmf 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\media\cagcat10\j0222015.wmf 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\addtoviewarrowmask.bmp 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.xml 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0187647.wmf 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files\mozilla firefox\browser\features\[email protected] 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files\windows sidebar\gadgets\mediacenter.gadget\images\gadget_star_empty.png 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files\windows sidebar\gadgets\slideshow.gadget\images\blank.png 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\document themes 14\hardcover.thmx 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\clock.gadget\es-es\css\settings.css 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\pets\rollinghills.png 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_ja_4.4.0.v20140623020002.jar 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File created C:\program files\microsoft games\multiplayer\checkers\es-es\Restore-My-Files.txt 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files\videolan\vlc\documentation.url 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0099168.jpg 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\document themes 14\theme fonts\metro.xml 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File created C:\program files (x86)\microsoft office\office14\convert\1033\Restore-My-Files.txt 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File created C:\program files\java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\meta-inf\Restore-My-Files.txt 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_ja.jar 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files\windows sidebar\gadgets\slideshow.gadget\en-us\gadget.xml 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\an01174_.wmf 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\so00828_.wmf 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\document themes 14\theme fonts\apothecary.xml 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\media\office14\lines\bd21303_.gif 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\media\office14\lines\bd21413_.gif 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File created C:\program files\java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\Restore-My-Files.txt 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_ja_4.4.0.v20140623020002.jar 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0281243.wmf 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formstemplates\track issues.fdt 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File created C:\program files\videolan\vlc\locale\ga\lc_messages\Restore-My-Files.txt 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0200273.wmf 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files\windows sidebar\gadgets\weather.gadget\images\39.png 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0153095.wmf 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\so00168_.wmf 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe File opened for modification C:\program files (x86)\microsoft office\media\cagcat10\j0235319.wmf 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 360 vssadmin.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \Registry\Machine\Software\Classes\.lockbit 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe Key created \Registry\Machine\Software\Classes\.lockbit\DefaultIcon 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lockbit\DefaultIcon\ = "C:\\windows\\SysWow64\\D220E4.ico" 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe Token: SeDebugPrivilege 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe Token: SeBackupPrivilege 2056 vssvc.exe Token: SeRestorePrivilege 2056 vssvc.exe Token: SeAuditPrivilege 2056 vssvc.exe Token: SeIncreaseQuotaPrivilege 1204 WMIC.exe Token: SeSecurityPrivilege 1204 WMIC.exe Token: SeTakeOwnershipPrivilege 1204 WMIC.exe Token: SeLoadDriverPrivilege 1204 WMIC.exe Token: SeSystemProfilePrivilege 1204 WMIC.exe Token: SeSystemtimePrivilege 1204 WMIC.exe Token: SeProfSingleProcessPrivilege 1204 WMIC.exe Token: SeIncBasePriorityPrivilege 1204 WMIC.exe Token: SeCreatePagefilePrivilege 1204 WMIC.exe Token: SeBackupPrivilege 1204 WMIC.exe Token: SeRestorePrivilege 1204 WMIC.exe Token: SeShutdownPrivilege 1204 WMIC.exe Token: SeDebugPrivilege 1204 WMIC.exe Token: SeSystemEnvironmentPrivilege 1204 WMIC.exe Token: SeRemoteShutdownPrivilege 1204 WMIC.exe Token: SeUndockPrivilege 1204 WMIC.exe Token: SeManageVolumePrivilege 1204 WMIC.exe Token: 33 1204 WMIC.exe Token: 34 1204 WMIC.exe Token: 35 1204 WMIC.exe Token: SeIncreaseQuotaPrivilege 1204 WMIC.exe Token: SeSecurityPrivilege 1204 WMIC.exe Token: SeTakeOwnershipPrivilege 1204 WMIC.exe Token: SeLoadDriverPrivilege 1204 WMIC.exe Token: SeSystemProfilePrivilege 1204 WMIC.exe Token: SeSystemtimePrivilege 1204 WMIC.exe Token: SeProfSingleProcessPrivilege 1204 WMIC.exe Token: SeIncBasePriorityPrivilege 1204 WMIC.exe Token: SeCreatePagefilePrivilege 1204 WMIC.exe Token: SeBackupPrivilege 1204 WMIC.exe Token: SeRestorePrivilege 1204 WMIC.exe Token: SeShutdownPrivilege 1204 WMIC.exe Token: SeDebugPrivilege 1204 WMIC.exe Token: SeSystemEnvironmentPrivilege 1204 WMIC.exe Token: SeRemoteShutdownPrivilege 1204 WMIC.exe Token: SeUndockPrivilege 1204 WMIC.exe Token: SeManageVolumePrivilege 1204 WMIC.exe Token: 33 1204 WMIC.exe Token: 34 1204 WMIC.exe Token: 35 1204 WMIC.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2936 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 27 PID 2036 wrote to memory of 2936 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 27 PID 2036 wrote to memory of 2936 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 27 PID 2036 wrote to memory of 2936 2036 0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe 27 PID 2936 wrote to memory of 360 2936 cmd.exe 29 PID 2936 wrote to memory of 360 2936 cmd.exe 29 PID 2936 wrote to memory of 360 2936 cmd.exe 29 PID 2936 wrote to memory of 1204 2936 cmd.exe 32 PID 2936 wrote to memory of 1204 2936 cmd.exe 32 PID 2936 wrote to memory of 1204 2936 cmd.exe 32 PID 2936 wrote to memory of 2300 2936 cmd.exe 34 PID 2936 wrote to memory of 2300 2936 cmd.exe 34 PID 2936 wrote to memory of 2300 2936 cmd.exe 34 PID 2936 wrote to memory of 2600 2936 cmd.exe 35 PID 2936 wrote to memory of 2600 2936 cmd.exe 35 PID 2936 wrote to memory of 2600 2936 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe"C:\Users\Admin\AppData\Local\Temp\0dcbc979c995eeec6e76fa87dfc301228d230101b9acecba53289c1c085eadb1.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:360
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1204
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2300
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2600
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2056