Malware Analysis Report

2024-09-11 01:53

Sample ID 230822-kxla6scf9v
Target 860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7
SHA256 860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7
Tags
medusalocker evasion ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7

Threat Level: Known bad

The file 860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7 was found to be: Known bad.

Malicious Activity Summary

medusalocker evasion ransomware spyware stealer trojan

Medusalocker family

UAC bypass

MedusaLocker

MedusaLocker payload

Deletes shadow copies

Renames multiple (199) files with added filename extension

Renames multiple (281) files with added filename extension

Executes dropped EXE

Reads user/profile data of web browsers

Enumerates connected drives

Drops desktop.ini file(s)

Unsigned PE

Enumerates physical storage devices

System policy modification

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Interacts with shadow copies

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Defense Evasion
TA0005
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Impair Defenses
T1562
Disable or Modify Tools
T1562.001
Modify Registry
T1112
Indicator Removal
T1070
File Deletion
T1070.004
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
Peripheral Device Discovery
T1120
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Inhibit System Recovery
T1490
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2023-08-22 08:58

Signatures

MedusaLocker payload

Description Indicator Process Target
N/A N/A N/A N/A

Medusalocker family

medusalocker

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-08-22 08:58

Reported

2023-08-22 09:01

Platform

win7-20230712-en

Max time kernel

128s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe"

Signatures

MedusaLocker

ransomware medusalocker

MedusaLocker payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A

Deletes shadow copies

ransomware

Renames multiple (281) files with added filename extension

ransomware

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-2969888527-3102471180-2307688834-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1736 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1736 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1736 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1736 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1736 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1736 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1736 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1736 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1736 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1736 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1736 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1736 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1736 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1736 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1736 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1736 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1736 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1736 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1736 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1736 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1736 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1736 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1736 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1736 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 1092 wrote to memory of 680 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\svhost.exe
PID 1092 wrote to memory of 680 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\svhost.exe
PID 1092 wrote to memory of 680 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\svhost.exe
PID 1092 wrote to memory of 680 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\svhost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe

"C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe"

C:\Windows\SysWOW64\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\taskeng.exe

taskeng.exe {0688F4B0-9D09-4AF8-9703-94C889448A54} S-1-5-21-2969888527-3102471180-2307688834-1000:YKQDESCX\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\svhost.exe

C:\Users\Admin\AppData\Roaming\svhost.exe

Network

N/A

Files

\Device\HarddiskVolume1\Boot\!-Recovery_Instructions-!.html

MD5 fef0fff3fd9b20a31cf184d43c424d6c
SHA1 fa19f775868ddf0db8930b48b14211c832e067c6
SHA256 10dc9a8e93e23e880ab52c4815070dcdd79ff8d9fe8d51c24af46dcb817513ad
SHA512 363645db919bd2e2a8fc87ed1a3d5392a727f3a07edb9330c7560cf7650bf54337a1d2bbbbe8b817a79f1628c2b7b5b28a3aea9a6c87c86c3803a4d9435a740f

C:\Users\Default\NTUSER.DAT.LOG2

MD5 35851b834f9c8629b7be034a5efeee66
SHA1 886e83de2641518b09efe7790f732d7e4d514b9d
SHA256 85d010b32cf2cb0a715999b7ba985aa385908ddbb986bbfe087b5565e98d0aaf
SHA512 16596d11896dbc06650cfc7fe48d45c1f56af3f1b930e85e7eec5e8d92d864ff129ba077c2fa9bec05816c772658dc5086501a139fd4b747c6613ce3ab888f4d

C:\Users\Admin\AppData\Roaming\svhost.exe

MD5 1a018c68582e13d7f51aa58f87e2ed50
SHA1 9568f4a2959eda46af35c5d18c190f0d85047ac3
SHA256 860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7
SHA512 a6775058f5ee5adc24b1f3fb6dbd29d9b0315e17a7061679bcda146a377912cf46292456435af27fd7790b6a8cc83025c4964c6526cdf1528cd55e8d68c1b7c9

C:\Users\Admin\AppData\Roaming\svhost.exe

MD5 1a018c68582e13d7f51aa58f87e2ed50
SHA1 9568f4a2959eda46af35c5d18c190f0d85047ac3
SHA256 860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7
SHA512 a6775058f5ee5adc24b1f3fb6dbd29d9b0315e17a7061679bcda146a377912cf46292456435af27fd7790b6a8cc83025c4964c6526cdf1528cd55e8d68c1b7c9

Analysis: behavioral2

Detonation Overview

Submitted

2023-08-22 08:58

Reported

2023-08-22 09:01

Platform

win10v2004-20230703-en

Max time kernel

142s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe"

Signatures

MedusaLocker

ransomware medusalocker

MedusaLocker payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A

Renames multiple (199) files with added filename extension

ransomware

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\svhost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-1043950675-1972537973-2972532878-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3768 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 3768 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 3768 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 3768 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 3768 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 3768 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 3768 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 3768 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\Wbem\wmic.exe
PID 3768 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe C:\Windows\SysWOW64\Wbem\wmic.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe

"C:\Users\Admin\AppData\Local\Temp\860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7.exe"

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Users\Admin\AppData\Roaming\svhost.exe

C:\Users\Admin\AppData\Roaming\svhost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 24.73.42.20.in-addr.arpa udp

Files

\Device\HarddiskVolume1\Boot\!-Recovery_Instructions-!.html

MD5 d8fb98b009e58322f755623dedf3028a
SHA1 5f24987c8b5867477b11488bf05cdaba17a12489
SHA256 6145533ef0f1ef3f3963bb0f45b3dd6ffb6bdea40c738646423f6a735854adbe
SHA512 4a923fcf8427daddd17ad63520464123dc23f9095ca3190824a9a54be647c0fd9ade65740b0ac4b92fa77d55844597f04fce98bd28448ce29ae7e2e23d3513df

C:\Users\Default\ntuser.dat.LOG2

MD5 9deb71e4029adb8eb7f65df1121347e1
SHA1 5bbc35b95c4e4790f1163e5468bd5256c1d75f40
SHA256 cb00b0c6a4809a9374b3385f740552fc11017894124e9be9c98ac10e499376aa
SHA512 3557a6c539af32d491825d1eb5e63504959ed974165f1608ff8544bd7da7a3cf6ea9ec9da909bf5fa0d4a481b79546e5fe7004d05b0a32b74029a6f80373dbb5

C:\Users\Admin\AppData\Roaming\svhost.exe

MD5 1a018c68582e13d7f51aa58f87e2ed50
SHA1 9568f4a2959eda46af35c5d18c190f0d85047ac3
SHA256 860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7
SHA512 a6775058f5ee5adc24b1f3fb6dbd29d9b0315e17a7061679bcda146a377912cf46292456435af27fd7790b6a8cc83025c4964c6526cdf1528cd55e8d68c1b7c9

C:\Users\Admin\AppData\Roaming\svhost.exe

MD5 1a018c68582e13d7f51aa58f87e2ed50
SHA1 9568f4a2959eda46af35c5d18c190f0d85047ac3
SHA256 860154eb48c722136e8c84b14a528be602aa6bc3de77523ea4d9490f280f69d7
SHA512 a6775058f5ee5adc24b1f3fb6dbd29d9b0315e17a7061679bcda146a377912cf46292456435af27fd7790b6a8cc83025c4964c6526cdf1528cd55e8d68c1b7c9