Analysis
-
max time kernel
88s -
max time network
114s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
12/03/2023, 05:34
Static task
static1
Behavioral task
behavioral1
Sample
111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe
Resource
win10v2004-20230220-en
General
-
Target
111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe
-
Size
554KB
-
MD5
523190c8adb9f67f54bd299c9175d4e8
-
SHA1
1a736dfd8806f898e529b0f713b4e7bc44f75742
-
SHA256
111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d
-
SHA512
5d687fc67221694e4227b5f7b11ab0caa6be64d647893ce25901a0282cc1040792691a7a8390b63581b33e52d2d466c97b9b0ceae1114e54a5a253d07a1c6fc6
-
SSDEEP
12288:9SUCXw8ZeNj+qIpyt9xPRQ+KQmIStn3iHfVt+K:9SUDNOyxPq+PSt3i0K
Malware Config
Extracted
C:\Program Files\Java\jdk1.7.0_80\db\Restore-My-Files.txt
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
https://bigblog.at
http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
https://decoding.at
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2636 bcdedit.exe 3960 bcdedit.exe -
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\HideNew.raw => C:\users\admin\pictures\hidenew.raw.lockbit 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File renamed C:\Users\Admin\Pictures\SyncPush.tiff => C:\users\admin\pictures\syncpush.tiff.lockbit 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File renamed C:\Users\Admin\Pictures\UninstallMerge.raw => C:\users\admin\pictures\uninstallmerge.raw.lockbit 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\users\admin\pictures\syncpush.tiff 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File renamed C:\Users\Admin\Pictures\CopyFormat.crw => C:\users\admin\pictures\copyformat.crw.lockbit 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows\CurrentVersion\Run\{B35BA88F-AAAA-7B1F-859C-850F9029E88E} = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe\"" 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\windows\SysWOW64\8E5BB0.ico 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 20 IoCs
pid Process 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\program files\dvd maker\shared\dvdstyles\sports\scenebuttonsubpicture.png 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\zi\asia\omsk 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File created C:\program files\microsoft games\solitaire\fr-fr\Restore-My-Files.txt 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files\windows sidebar\gadgets\mediacenter.gadget\images\gadget_star_empty.png 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\ag00037_.gif 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0382966.jpg 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\resizingpanels\navigationup_buttongraphic.png 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\visualvm\config\modules\com-sun-tools-visualvm-jvmstat.xml 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\windows mail\fr-fr\msoeres.dll.mui 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File created C:\program files\java\jdk1.7.0_80\jre\lib\deploy\Restore-My-Files.txt 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files\windows sidebar\gadgets\currency.gadget\fr-fr\js\localizedstrings.js 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\fd00077_.wmf 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\microsoft office\media\office14\lines\bd15072_.gif 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\microsoft office\office14\pubba\mspub2a.bdr 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\slideshow.gadget\logo.png 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files\windows sidebar\gadgets\picturepuzzle.gadget\images\daisies.png 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\pe03731_.wmf 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\microsoft office\document themes 14\urban.thmx 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\toolbmps\questioniconmask.bmp 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.properties 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-queries.xml 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files\windows sidebar\gadgets\weather.gadget\images\47.png 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\so00177_.wmf 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\microsoft office\office14\accessweb\rpt2htm4.xsl 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi_3.10.1.v20140909-1633.jar 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\config\modules\org-netbeans-modules-keyring-fallback.xml 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\toolbmps\spacebackupicons.jpg 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\microsoft office\office14\pagesize\pgmn020.xml 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\microsoft office\templates\1033\urbanmergefax.dotx 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\windows mail\it-it\winmail.exe.mui 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\picturepuzzle.gadget\images\tile16.png 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files\videolan\vlc\lua\http\images\vlc-48.png 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\adobe\reader 9.0\reader\plug_ins\vdkhome\enu\vdk10.syd 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\hh01291_.wmf 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\slideshow.gadget\it-it\js\slideshow.js 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\picturepuzzle.gadget\it-it\gadget.xml 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\rssfeeds.gadget\es-es\css\flyout.css 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\zi\america\puerto_rico 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help_3.6.0.v20130326-1254.jar 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\pe00563_.wmf 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\cpu.gadget\ja-jp\js\cpu.js 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggeractions.exsd 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files\java\jre7\lib\zi\europe\copenhagen 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files\windows sidebar\gadgets\mediacenter.gadget\css\flyout.css 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0187883.wmf 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms\menu_arrow.gif 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\microsoft office\office14\pubwiz\brochure.xml 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0200189.wmf 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\microsoft office\media\office14\bullets\bd15134_.gif 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\slideshow.gadget\images\in_sidebar\slideshow_glass_frame.png 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\zi\america\nipigon 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0200273.wmf 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0239941.wmf 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\na01161_.wmf 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\microsoft office\office14\1033\grooveforms5\formsstyles\brightorange.css 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-outline.jar 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\slideshow.gadget\it-it\slideshow.html 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\dd01039_.wmf 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files (x86)\microsoft office\office14\pubwiz\banner.xml 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File created C:\program files (x86)\microsoft office\templates\1033\access\Restore-My-Files.txt 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\rectangle_travel_thumbnail.bmp 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files\java\jre7\lib\zi\europe\tirane 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File created C:\program files\videolan\vlc\locale\kk\lc_messages\Restore-My-Files.txt 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe File opened for modification C:\program files\videolan\vlc\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2056 vssadmin.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \Registry\Machine\Software\Classes\.lockbit 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe Key created \Registry\Machine\Software\Classes\.lockbit\DefaultIcon 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lockbit\DefaultIcon\ = "C:\\windows\\SysWow64\\8E5BB0.ico" 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe Token: SeDebugPrivilege 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe Token: SeBackupPrivilege 2084 vssvc.exe Token: SeRestorePrivilege 2084 vssvc.exe Token: SeAuditPrivilege 2084 vssvc.exe Token: SeIncreaseQuotaPrivilege 2880 WMIC.exe Token: SeSecurityPrivilege 2880 WMIC.exe Token: SeTakeOwnershipPrivilege 2880 WMIC.exe Token: SeLoadDriverPrivilege 2880 WMIC.exe Token: SeSystemProfilePrivilege 2880 WMIC.exe Token: SeSystemtimePrivilege 2880 WMIC.exe Token: SeProfSingleProcessPrivilege 2880 WMIC.exe Token: SeIncBasePriorityPrivilege 2880 WMIC.exe Token: SeCreatePagefilePrivilege 2880 WMIC.exe Token: SeBackupPrivilege 2880 WMIC.exe Token: SeRestorePrivilege 2880 WMIC.exe Token: SeShutdownPrivilege 2880 WMIC.exe Token: SeDebugPrivilege 2880 WMIC.exe Token: SeSystemEnvironmentPrivilege 2880 WMIC.exe Token: SeRemoteShutdownPrivilege 2880 WMIC.exe Token: SeUndockPrivilege 2880 WMIC.exe Token: SeManageVolumePrivilege 2880 WMIC.exe Token: 33 2880 WMIC.exe Token: 34 2880 WMIC.exe Token: 35 2880 WMIC.exe Token: SeIncreaseQuotaPrivilege 2880 WMIC.exe Token: SeSecurityPrivilege 2880 WMIC.exe Token: SeTakeOwnershipPrivilege 2880 WMIC.exe Token: SeLoadDriverPrivilege 2880 WMIC.exe Token: SeSystemProfilePrivilege 2880 WMIC.exe Token: SeSystemtimePrivilege 2880 WMIC.exe Token: SeProfSingleProcessPrivilege 2880 WMIC.exe Token: SeIncBasePriorityPrivilege 2880 WMIC.exe Token: SeCreatePagefilePrivilege 2880 WMIC.exe Token: SeBackupPrivilege 2880 WMIC.exe Token: SeRestorePrivilege 2880 WMIC.exe Token: SeShutdownPrivilege 2880 WMIC.exe Token: SeDebugPrivilege 2880 WMIC.exe Token: SeSystemEnvironmentPrivilege 2880 WMIC.exe Token: SeRemoteShutdownPrivilege 2880 WMIC.exe Token: SeUndockPrivilege 2880 WMIC.exe Token: SeManageVolumePrivilege 2880 WMIC.exe Token: 33 2880 WMIC.exe Token: 34 2880 WMIC.exe Token: 35 2880 WMIC.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2032 wrote to memory of 1756 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe 29 PID 2032 wrote to memory of 1756 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe 29 PID 2032 wrote to memory of 1756 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe 29 PID 2032 wrote to memory of 1756 2032 111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe 29 PID 1756 wrote to memory of 2056 1756 cmd.exe 31 PID 1756 wrote to memory of 2056 1756 cmd.exe 31 PID 1756 wrote to memory of 2056 1756 cmd.exe 31 PID 1756 wrote to memory of 2880 1756 cmd.exe 34 PID 1756 wrote to memory of 2880 1756 cmd.exe 34 PID 1756 wrote to memory of 2880 1756 cmd.exe 34 PID 1756 wrote to memory of 2636 1756 cmd.exe 36 PID 1756 wrote to memory of 2636 1756 cmd.exe 36 PID 1756 wrote to memory of 2636 1756 cmd.exe 36 PID 1756 wrote to memory of 3960 1756 cmd.exe 37 PID 1756 wrote to memory of 3960 1756 cmd.exe 37 PID 1756 wrote to memory of 3960 1756 cmd.exe 37 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\111093146452b46071976d594172bc81d66427651f5f4cc244ddad9b3eae5c7d.bin.sample.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2056
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2636
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:3960
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2084
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD5f88a6e9f47e25160ebe1174ed360a8f1
SHA1e5395df9fcab6d5bb6fa7b6b0e0c130c0b863a08
SHA256d6162a0afecd225bd289cd7c10963c93eb28ae27a18888d61d01b16d9eee0b33
SHA5126853912312dfeb53853111b55ac2d77e9cce1f534689b1acbd11235106601c914b1431df12a7c65ec0726b45cc96df62bf39cc23f770d05569adfdebb10b0a75