Analysis
- max time kernel
361s - max time network
364s - platform
windows7_x64 - resource
win7-20230831-en - resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system - submitted
05/09/2023, 00:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe
Resource
win7-20230831-en
windows7-x64
11 signatures
600 seconds
Behavioral task
behavioral2
Sample
c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe
Resource
win10v2004-20230831-en
windows10-2004-x64
14 signatures
600 seconds
General
- Target c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe
- Size 138KB
- Sample230905-af2aysce99
- SHA256 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20
- MD5 ceececadd6c0a7265c3ca3d01ec9d20f
- SHA1 6154b81d146a4c7dedbbb546081628626a20e469
- SHA512 cef796740651ce4231748928eec48540e2d0dc68770cb88e3f61ca85c3716761a521a1d66adfe6fbdd37edf5e75d5d8fa7d8eee5d256a9b4f41dc1b9812c86f9
- SSDEEP 3072:tPgv1uTga8za7/aApO6fCR6kMgNjTX8jI8VD/dJJO04aN5uvvmRE7xIxT62B009Q:tKZTMPVDdzR1N5sAxKN9dRd
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Renames multiple (9324) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened (read-only) \??\D: c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.xml.EMAIL=[[email protected]]ID=[A7BF40638C0B7184].rival c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe.config.EMAIL=[[email protected]]ID=[A7BF40638C0B7184].rival c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\settings.js c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\new-trigger-wiz.gif.EMAIL=[[email protected]]ID=[A7BF40638C0B7184].rival c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Teal.css c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\winamp2.xml c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR6B.GIF c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo.EMAIL=[[email protected]]ID=[A7BF40638C0B7184].rival c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Rankin_Inlet.EMAIL=[[email protected]]ID=[A7BF40638C0B7184].rival c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\Windows Defender\en-US\MpEvMsg.dll.mui c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\OPTINPS.DLL c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\JPEGIM32.FLT c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\js\main.js c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\30.png c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\Mozilla Firefox\fonts\TwemojiMozilla.ttf c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Maputo.EMAIL=[[email protected]]ID=[A7BF40638C0B7184].rival c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl.css.EMAIL=[[email protected]]ID=[A7BF40638C0B7184].rival c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Essential.eftx c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSHY7FR.LEX c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\FLYER11.POC.EMAIL=[[email protected]]ID=[A7BF40638C0B7184].rival c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\47.png c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ACEODBCI.DLL c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html.EMAIL=[[email protected]]ID=[A7BF40638C0B7184].rival c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Csi.dll c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationBuildTasks.resources.dll c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.properties.EMAIL=[[email protected]]ID=[A7BF40638C0B7184].rival c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0297229.WMF.EMAIL=[[email protected]]ID=[A7BF40638C0B7184].rival c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART5.BDR.EMAIL=[[email protected]]ID=[A7BF40638C0B7184].rival c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libnfs_plugin.dll.EMAIL=[[email protected]]ID=[A7BF40638C0B7184].rival c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\THMBNAIL.PNG c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\Mozilla Firefox\ipcclientcerts.dll c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll.EMAIL=[[email protected]]ID=[A7BF40638C0B7184].rival c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187847.WMF.EMAIL=[[email protected]]ID=[A7BF40638C0B7184].rival c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\settings.html c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-attach.xml.EMAIL=[[email protected]]ID=[A7BF40638C0B7184].rival c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02371_.WMF c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxwebkit.dll c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql70.xsl c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14829_.GIF.EMAIL=[[email protected]]ID=[A7BF40638C0B7184].rival c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Windhoek c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0177806.JPG.EMAIL=[[email protected]]ID=[A7BF40638C0B7184].rival c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309598.JPG.EMAIL=[[email protected]]ID=[A7BF40638C0B7184].rival c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\Java\jre7\lib\sound.properties.EMAIL=[[email protected]]ID=[A7BF40638C0B7184].rival c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ENES\MSB1ENES.ITS c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.RuntimeUi.dll.EMAIL=[[email protected]]ID=[A7BF40638C0B7184].rival c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\powerpnt.exe.manifest.EMAIL=[[email protected]]ID=[A7BF40638C0B7184].rival c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\RMNSQUE.INF c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\Office64WW.XML c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_HighMask.bmp.EMAIL=[[email protected]]ID=[A7BF40638C0B7184].rival c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\MeasureUnprotect.ppt c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_divider_left.png c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\NOTEBOOK.JPG.EMAIL=[[email protected]]ID=[A7BF40638C0B7184].rival c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libupnp_plugin.dll.EMAIL=[[email protected]]ID=[A7BF40638C0B7184].rival c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18193_.WMF.EMAIL=[[email protected]]ID=[A7BF40638C0B7184].rival c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR9F.GIF c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2724 vssadmin.exe 2580 vssadmin.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 2692 vssvc.exe Token: SeRestorePrivilege 2692 vssvc.exe Token: SeAuditPrivilege 2692 vssvc.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2564 wrote to memory of 2884 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 29 PID 2564 wrote to memory of 2884 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 29 PID 2564 wrote to memory of 2884 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 29 PID 2564 wrote to memory of 2884 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 29 PID 2884 wrote to memory of 2724 2884 cmd.exe 31 PID 2884 wrote to memory of 2724 2884 cmd.exe 31 PID 2884 wrote to memory of 2724 2884 cmd.exe 31 PID 2564 wrote to memory of 2548 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 37 PID 2564 wrote to memory of 2548 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 37 PID 2564 wrote to memory of 2548 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 37 PID 2564 wrote to memory of 2548 2564 c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe 37 PID 2548 wrote to memory of 2580 2548 cmd.exe 39 PID 2548 wrote to memory of 2580 2548 cmd.exe 39 PID 2548 wrote to memory of 2580 2548 cmd.exe 39 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe"C:\Users\Admin\AppData\Local\Temp\c638ac1eeef2c97901d6a67e8669a265fecb16eeccda7c49b47e78667cc1fe20.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2724
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2580
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\FILE ENCRYPTED.txt
- Size 330B
- SHA256 be13ce3677357d50cd909b8acb34721a3a683539f40e05d978ee44ced8e1fdbe
- MD5 04ff194c9661cb2e9602921f806618d5
- SHA1 79efc9c5ac8680178f9652bf9abf814445859769
- SHA512 9e69960e4ea93625c8b40d93420a2b6186af642efce246c6f627c173e18edc392a558cfd3245c9aa5bac4150f5595d4a47f9360d088d6a800a705f72c719161c
- MD5 SHA1 SHA512