Analysis
-
max time kernel
91s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-12-2022 14:55
Behavioral task
behavioral1
Sample
dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe
Resource
win10v2004-20220812-en
General
-
Target
dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe
-
Size
396KB
-
MD5
6a956731b3677dd9d4d18641d40532ab
-
SHA1
1994ee0b381c5528d5b5c01fb97a14b5ff81e5a5
-
SHA256
dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309
-
SHA512
314d87605dfe01cfb83a8b6ff17e98fc933f012ef933557d1899ebf0941d892a37f0d0692d99a3cd7061ce6c2c90a6dafe7b8dbb80ae875d9c368529f0b87991
-
SSDEEP
1536:n28VgV1U8ZGURVFB3eH/omAhUfKQnSz+jS7ddpjHXSeSv3caALL95T:28VgV1UqGgVFBKo8ybdz
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\readme-warning.txt
makop
coleman.dec@tutanota.com
lauracc@msgsafe.io
Signatures
-
Makop
Ransomware family discovered by @VK_Intel in early 2020.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
svchost.exedescription pid process target process PID 2536 created 4756 2536 svchost.exe dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Processes:
wbadmin.exepid process 4708 wbadmin.exe -
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\ImportRedo.tiff dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Program Files directory 64 IoCs
Processes:
dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\Square310x310Logo.scale-200.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreWideTile.scale-200.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filter_18.svg dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-64_altform-lightunplated.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageMedTile.scale-400.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-16_altform-lightunplated.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\readme-warning.txt dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_TileMediumSquare.scale-200.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp7.scale-100.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\PlaceholderCollectionHero.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\cs-cz\ui-strings.js dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.emf.ecore.change_2.10.0.v20140901-1043.jar dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-256_altform-unplated.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.scale-200.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-40_altform-unplated_contrast-white.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\readme-warning.txt dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosMedTile.contrast-white_scale-125.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-200_contrast-high.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-32.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\Be.ps1 dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsMedTile.contrast-black_scale-125.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreBadgeLogo.scale-200.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.Tasks.winmd dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\classlist dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\Blog.dotx dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionSmallTile.scale-400.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Dtmf_5.m4a dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ja_135x40.svg dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc.did dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\THMBNAIL.PNG dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsLargeTile.scale-125.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-60_altform-unplated_contrast-black.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsStoreLogo.contrast-white_scale-100.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-progress-ui.xml dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hr-hr\readme-warning.txt dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\readme-warning.txt dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\plugins\rhp\pages-app-selector.js dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\readme-warning.txt dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\readme-warning.txt dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\readme-warning.txt dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.targetsize-24_altform-unplated_contrast-white.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\share.svg dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-fr\ui-strings.js dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\TimerWideTile.contrast-white_scale-200.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-64_altform-lightunplated.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\SegMVR2.ttf dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ul-oob.xrm-ms dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hr-hr\readme-warning.txt dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\de-de\readme-warning.txt dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\nn.pak dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\readme-warning.txt dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\TinyTile.scale-200_contrast-black.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-60_altform-unplated_contrast-black.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-256_altform-lightunplated.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\uk-ua\readme-warning.txt dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-ae\ui-strings.js dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe -
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vds.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1576 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exepid process 4756 dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe 4756 dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
Processes:
svchost.exevssvc.exewbengine.exeWMIC.exedescription pid process Token: SeTcbPrivilege 2536 svchost.exe Token: SeTcbPrivilege 2536 svchost.exe Token: SeBackupPrivilege 4832 vssvc.exe Token: SeRestorePrivilege 4832 vssvc.exe Token: SeAuditPrivilege 4832 vssvc.exe Token: SeBackupPrivilege 4796 wbengine.exe Token: SeRestorePrivilege 4796 wbengine.exe Token: SeSecurityPrivilege 4796 wbengine.exe Token: SeIncreaseQuotaPrivilege 4888 WMIC.exe Token: SeSecurityPrivilege 4888 WMIC.exe Token: SeTakeOwnershipPrivilege 4888 WMIC.exe Token: SeLoadDriverPrivilege 4888 WMIC.exe Token: SeSystemProfilePrivilege 4888 WMIC.exe Token: SeSystemtimePrivilege 4888 WMIC.exe Token: SeProfSingleProcessPrivilege 4888 WMIC.exe Token: SeIncBasePriorityPrivilege 4888 WMIC.exe Token: SeCreatePagefilePrivilege 4888 WMIC.exe Token: SeBackupPrivilege 4888 WMIC.exe Token: SeRestorePrivilege 4888 WMIC.exe Token: SeShutdownPrivilege 4888 WMIC.exe Token: SeDebugPrivilege 4888 WMIC.exe Token: SeSystemEnvironmentPrivilege 4888 WMIC.exe Token: SeRemoteShutdownPrivilege 4888 WMIC.exe Token: SeUndockPrivilege 4888 WMIC.exe Token: SeManageVolumePrivilege 4888 WMIC.exe Token: 33 4888 WMIC.exe Token: 34 4888 WMIC.exe Token: 35 4888 WMIC.exe Token: 36 4888 WMIC.exe Token: SeIncreaseQuotaPrivilege 4888 WMIC.exe Token: SeSecurityPrivilege 4888 WMIC.exe Token: SeTakeOwnershipPrivilege 4888 WMIC.exe Token: SeLoadDriverPrivilege 4888 WMIC.exe Token: SeSystemProfilePrivilege 4888 WMIC.exe Token: SeSystemtimePrivilege 4888 WMIC.exe Token: SeProfSingleProcessPrivilege 4888 WMIC.exe Token: SeIncBasePriorityPrivilege 4888 WMIC.exe Token: SeCreatePagefilePrivilege 4888 WMIC.exe Token: SeBackupPrivilege 4888 WMIC.exe Token: SeRestorePrivilege 4888 WMIC.exe Token: SeShutdownPrivilege 4888 WMIC.exe Token: SeDebugPrivilege 4888 WMIC.exe Token: SeSystemEnvironmentPrivilege 4888 WMIC.exe Token: SeRemoteShutdownPrivilege 4888 WMIC.exe Token: SeUndockPrivilege 4888 WMIC.exe Token: SeManageVolumePrivilege 4888 WMIC.exe Token: 33 4888 WMIC.exe Token: 34 4888 WMIC.exe Token: 35 4888 WMIC.exe Token: 36 4888 WMIC.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
svchost.exedc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.execmd.exedescription pid process target process PID 2536 wrote to memory of 1260 2536 svchost.exe dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe PID 2536 wrote to memory of 1260 2536 svchost.exe dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe PID 2536 wrote to memory of 1260 2536 svchost.exe dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe PID 2536 wrote to memory of 1260 2536 svchost.exe dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe PID 2536 wrote to memory of 1260 2536 svchost.exe dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe PID 2536 wrote to memory of 1260 2536 svchost.exe dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe PID 2536 wrote to memory of 1260 2536 svchost.exe dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe PID 4756 wrote to memory of 5112 4756 dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe cmd.exe PID 4756 wrote to memory of 5112 4756 dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe cmd.exe PID 5112 wrote to memory of 1576 5112 cmd.exe vssadmin.exe PID 5112 wrote to memory of 1576 5112 cmd.exe vssadmin.exe PID 5112 wrote to memory of 4708 5112 cmd.exe wbadmin.exe PID 5112 wrote to memory of 4708 5112 cmd.exe wbadmin.exe PID 5112 wrote to memory of 4888 5112 cmd.exe WMIC.exe PID 5112 wrote to memory of 4888 5112 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe"C:\Users\Admin\AppData\Local\Temp\dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe"C:\Users\Admin\AppData\Local\Temp\dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe" n47562⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)