Analysis
-
max time kernel
66s -
max time network
83s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
05/06/2023, 12:17
Static task
static1
Behavioral task
behavioral1
Sample
8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe
Resource
win10v2004-20230220-en
General
-
Target
8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe
-
Size
552KB
-
MD5
a27b6bfb8e6aef454395cbab2bdf7cd1
-
SHA1
4a60125f0964f4992471c37d606fb0fdb4d98eb6
-
SHA256
8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c
-
SHA512
5bf76dbfe740cfa7a78c65a9d51ecc0c120a828baa683a336b73cbb3b58ef2765759f186cd082adc04675c0bfe20c9b252074dadaa148ab67debc5ac74922d57
-
SSDEEP
12288:F8ENlAKnykvnA6NkSo3wtfVx9Edm3pd4bOjxeEUYQc5aYWyQ0h75:SENlF4rRqfVxQGp7jN5aBWV5
Malware Config
Extracted
C:\Program Files\Java\jdk1.7.0_80\db\Restore-My-Files.txt
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
https://bigblog.at
http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
https://decoding.at
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 4364 bcdedit.exe 4692 bcdedit.exe -
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\EnterEdit.tif => C:\users\admin\pictures\enteredit.tif.lockbit 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File renamed C:\Users\Admin\Pictures\JoinClear.png => C:\users\admin\pictures\joinclear.png.lockbit 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File renamed C:\Users\Admin\Pictures\JoinInitialize.png => C:\users\admin\pictures\joininitialize.png.lockbit 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File renamed C:\Users\Admin\Pictures\ConnectUnprotect.png => C:\users\admin\pictures\connectunprotect.png.lockbit 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows\CurrentVersion\Run\{38AC233C-9696-277B-92F6-9248B95182A7} = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe\"" 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\windows\SysWOW64\B3ACB0.ico 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 20 IoCs
pid Process 1324 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe 1324 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe 1324 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe 1324 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe 1324 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe 1324 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe 1324 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe 1324 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe 1324 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe 1324 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe 1324 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe 1324 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe 1324 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe 1324 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe 1324 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe 1324 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe 1324 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe 1324 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe 1324 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe 1324 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\program files\java\jre7\lib\javafx.properties 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files\java\jre7\lib\zi\america\monterrey 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files\java\jre7\lib\zi\etc\gmt+7 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0382948.jpg 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\slate\tab_off.gif 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files\7-zip\lang\fa.txt 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-modules-profiler_visualvm.jar 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files\windows sidebar\gadgets\picturepuzzle.gadget\en-us\js\settings.js 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File created C:\program files (x86)\adobe\reader 9.0\resource\font\pfm\Restore-My-Files.txt 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\microsoft office\office14\xml2word.xsl 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\clock.gadget\images\cronometer_h.png 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\alert_obj.png 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0099200.gif 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\pe02282_.wmf 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsbrowserupgrade.html 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\microsoft office\office14\pubwiz\flyer.xml 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\microsoft office\office14\pubwiz\dgwebsbr.dpv 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\dropins\readme.txt 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files\java\jre7\lib\zi\america\argentina\buenos_aires 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files\microsoft games\more games\it-it\moregames.dll.mui 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\adobe\reader 9.0\reader\plug_ins\sendmail.api 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0103058.wmf 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\pe00489_.wmf 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\microsoft office\clipart\publisher\backgrounds\wb02198_.gif 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\microsoft office\media\office14\lines\bd21324_.gif 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\babygirl\btn-previous-static.png 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands_3.6.100.v20140528-1422.jar 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_zh_4.4.0.v20140623020002.jar 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File created C:\program files\videolan\vlc\locale\uk\lc_messages\Restore-My-Files.txt 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0400003.png 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\microsoft visual studio 8\common7\ide\vsta\itemtemplates\visualbasic\1033\splashscreen.zip 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\picturepuzzle.gadget\en-us\css\settings.css 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_formshomepage.gif 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\zi\america\argentina\jujuy 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\zi\asia\aqtau 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\zi\systemv\hst10 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\adobe\reader 9.0\reader\plug_ins\vdkhome\vdk10.cmp 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\so02227_.wmf 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\microsoft office\office14\bibliography\sort\author.xsl 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\calendar.gadget\de-de\js\calendar.js 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\memories\16_9-frame-image-mask.png 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert.zh_cn_5.5.0.165303.jar 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_zh_4.4.0.v20140623020002.jar 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files\windows sidebar\gadgets\mediacenter.gadget\css\main.css 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\tn00218_.wmf 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\microsoft office\document themes 14\pushpin.thmx 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\zi\asia\riyadh 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-enumerations.xml 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files\windows sidebar\gadgets\weather.gadget\images\btn_search_up.png 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0099166.jpg 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\ph02058u.bmp 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File created C:\program files\microsoft games\more games\ja-jp\Restore-My-Files.txt 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-text.xml 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files\windows sidebar\gadgets\weather.gadget\images\undocked_black_moon-waning-gibbous_partly-cloudy.png 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\button_right_over.gif 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files\java\jre7\lib\zi\america\maceio 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\microsoft office\office14\1033\pubspapr\pdir1f.gif 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\microsoft office\office14\1033\pubspapr\zpdir00.gif 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\toolbmps\questionicon.jpg 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\brightyellow\header.gif 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files\java\jre7\lib\zi\america\north_dakota\center 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files\java\jre7\lib\zi\australia\hobart 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\rtf_choosecolor.gif 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe File opened for modification C:\program files (x86)\microsoft office\stationery\1033\judgesch.gif 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 676 vssadmin.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \Registry\Machine\Software\Classes\.lockbit\DefaultIcon 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lockbit\DefaultIcon\ = "C:\\windows\\SysWow64\\B3ACB0.ico" 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe Key created \Registry\Machine\Software\Classes\.lockbit 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1324 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe 1324 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe 1324 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1324 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe Token: SeDebugPrivilege 1324 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe Token: SeBackupPrivilege 952 vssvc.exe Token: SeRestorePrivilege 952 vssvc.exe Token: SeAuditPrivilege 952 vssvc.exe Token: SeIncreaseQuotaPrivilege 2948 WMIC.exe Token: SeSecurityPrivilege 2948 WMIC.exe Token: SeTakeOwnershipPrivilege 2948 WMIC.exe Token: SeLoadDriverPrivilege 2948 WMIC.exe Token: SeSystemProfilePrivilege 2948 WMIC.exe Token: SeSystemtimePrivilege 2948 WMIC.exe Token: SeProfSingleProcessPrivilege 2948 WMIC.exe Token: SeIncBasePriorityPrivilege 2948 WMIC.exe Token: SeCreatePagefilePrivilege 2948 WMIC.exe Token: SeBackupPrivilege 2948 WMIC.exe Token: SeRestorePrivilege 2948 WMIC.exe Token: SeShutdownPrivilege 2948 WMIC.exe Token: SeDebugPrivilege 2948 WMIC.exe Token: SeSystemEnvironmentPrivilege 2948 WMIC.exe Token: SeRemoteShutdownPrivilege 2948 WMIC.exe Token: SeUndockPrivilege 2948 WMIC.exe Token: SeManageVolumePrivilege 2948 WMIC.exe Token: 33 2948 WMIC.exe Token: 34 2948 WMIC.exe Token: 35 2948 WMIC.exe Token: SeIncreaseQuotaPrivilege 2948 WMIC.exe Token: SeSecurityPrivilege 2948 WMIC.exe Token: SeTakeOwnershipPrivilege 2948 WMIC.exe Token: SeLoadDriverPrivilege 2948 WMIC.exe Token: SeSystemProfilePrivilege 2948 WMIC.exe Token: SeSystemtimePrivilege 2948 WMIC.exe Token: SeProfSingleProcessPrivilege 2948 WMIC.exe Token: SeIncBasePriorityPrivilege 2948 WMIC.exe Token: SeCreatePagefilePrivilege 2948 WMIC.exe Token: SeBackupPrivilege 2948 WMIC.exe Token: SeRestorePrivilege 2948 WMIC.exe Token: SeShutdownPrivilege 2948 WMIC.exe Token: SeDebugPrivilege 2948 WMIC.exe Token: SeSystemEnvironmentPrivilege 2948 WMIC.exe Token: SeRemoteShutdownPrivilege 2948 WMIC.exe Token: SeUndockPrivilege 2948 WMIC.exe Token: SeManageVolumePrivilege 2948 WMIC.exe Token: 33 2948 WMIC.exe Token: 34 2948 WMIC.exe Token: 35 2948 WMIC.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1324 wrote to memory of 956 1324 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe 28 PID 1324 wrote to memory of 956 1324 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe 28 PID 1324 wrote to memory of 956 1324 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe 28 PID 1324 wrote to memory of 956 1324 8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe 28 PID 956 wrote to memory of 676 956 cmd.exe 30 PID 956 wrote to memory of 676 956 cmd.exe 30 PID 956 wrote to memory of 676 956 cmd.exe 30 PID 956 wrote to memory of 2948 956 cmd.exe 33 PID 956 wrote to memory of 2948 956 cmd.exe 33 PID 956 wrote to memory of 2948 956 cmd.exe 33 PID 956 wrote to memory of 4364 956 cmd.exe 35 PID 956 wrote to memory of 4364 956 cmd.exe 35 PID 956 wrote to memory of 4364 956 cmd.exe 35 PID 956 wrote to memory of 4692 956 cmd.exe 36 PID 956 wrote to memory of 4692 956 cmd.exe 36 PID 956 wrote to memory of 4692 956 cmd.exe 36 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe"C:\Users\Admin\AppData\Local\Temp\8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:676
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2948
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:4364
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:4692
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:952
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD576e5c3bdcef5b1aae6366faa15c3a7b4
SHA105332e9e250b92aeeca499805dd8a095010ae2b9
SHA25659bfd73027c0db6dbac36ae6beb73754fdf6ffe58efd15b21e07c18ee67f9656
SHA512a13fc63faa482eed5364b4034b9ae6466f80122bc3661da57071e418d23cc79620aadcb357792bca9d74d890d8fc11c236ce309e447c6a45e960ffcfe8b2efd2