Analysis
-
max time kernel
129s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31-12-2023 00:08
Behavioral task
behavioral1
Sample
2120cf93b6be39884f951ee2a31c5999.exe
Resource
win7-20231215-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
2120cf93b6be39884f951ee2a31c5999.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
2120cf93b6be39884f951ee2a31c5999.exe
-
Size
669KB
-
MD5
2120cf93b6be39884f951ee2a31c5999
-
SHA1
317b695da0ece90979f0400c2c7800e50bec8bb9
-
SHA256
c5bef2a489740192a0b2c34cdc2fd954d0b8d5fabcbe0ecb8b78f9301e5a30a6
-
SHA512
3038b27dcc263675a642f77d9dbaaff921c3a56f160051df44619dbafcd5d108db1c6caeacb70179c511e284035d329f29c34dd19500d2bd4006d2f86ee1dc33
-
SSDEEP
12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DKKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWjKrKe
Malware Config
Extracted
Path
\Device\HarddiskVolume1\Boot\HOW_TO_RECOVER_DATA.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">DBAB6D4BB6CB08F4DBC07DEB304DF9070E16421000A965FADCF289C82B97FCC9E44DFE4C49A4E44811008DF23B1ED925672A1C2A9038C9A3A9A2248C61B980D5<br>F8CDE03508ADFF32F7A05400238FCF2C9E17D5CCBB0323C574D41474EDD9B09071FA94BD9496E4E7C37AFCABE2F6A955AD5365FC91968419068C4E819C46<br>9262FF434AF2D29F2EAFA76EDF835C837AC6870F32F67BA11E32799F7FDB52FD1C19312CFC6147E4E8BEEDC7C0E1C52F5EABAA2A0D466B815517A08B0A84<br>45B4E1314D660D6B5534E377D47929C1876269F85B92058B1755705DAA50A3549B6B2372CAD5B3ADE51684084D202AE025EA51CD02F05F352A5BDE58686C<br>E578B149341328C21781FBB6CD4EE36E5C7ED454023431972453F68B4F9DD5D8CD0AED6B341C4EF34702060AB963DFFC97C0113E384A0C79666015A59E05<br>D1581F4FE49A2A7B095DC7FBC0F329FF47D6A22E89D4E862B82A6CAE316844EB194706EB2EE5563A65D5AD3A4C6F8840C6AF6FA9C6EE45E5081836C7C21B<br>F91E2CF433855A2D45DC18CF4B6A2DF8962D3D56ACF13809C1EA9197AECBA9DB349F1690FFEB7D65A700313BB75A4CC47C16A4D6410CC47992E65205C7A1<br>9110407AF0088EC0102531219F0E1475813395B0A484F5C361952D62F887628924A4E59246BE1CFE6C46E1D4F986CA51FE43E9E3F839298DB80ADF8E93A8<br>DC02E0CDF4AFC94957EF9D00693B</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open <a>qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</a><br>
4. Start a chat and follow the further instructions. <br><br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected] ">[email protected] </a>
<br><a href="[email protected]">[email protected]</a>
<br>
<b>* To contact us, create a new free email account on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload 1 IoCs
resource yara_rule behavioral1/files/0x000a000000012243-1021.dat family_medusalocker -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2120cf93b6be39884f951ee2a31c5999.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 2120cf93b6be39884f951ee2a31c5999.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (333) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
pid Process 2496 svhost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2120cf93b6be39884f951ee2a31c5999.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-3427588347-1492276948-3422228430-1000\desktop.ini 2120cf93b6be39884f951ee2a31c5999.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 2120cf93b6be39884f951ee2a31c5999.exe File opened (read-only) \??\E: 2120cf93b6be39884f951ee2a31c5999.exe File opened (read-only) \??\G: 2120cf93b6be39884f951ee2a31c5999.exe File opened (read-only) \??\I: 2120cf93b6be39884f951ee2a31c5999.exe File opened (read-only) \??\M: 2120cf93b6be39884f951ee2a31c5999.exe File opened (read-only) \??\N: 2120cf93b6be39884f951ee2a31c5999.exe File opened (read-only) \??\P: 2120cf93b6be39884f951ee2a31c5999.exe File opened (read-only) \??\T: 2120cf93b6be39884f951ee2a31c5999.exe File opened (read-only) \??\B: 2120cf93b6be39884f951ee2a31c5999.exe File opened (read-only) \??\H: 2120cf93b6be39884f951ee2a31c5999.exe File opened (read-only) \??\J: 2120cf93b6be39884f951ee2a31c5999.exe File opened (read-only) \??\K: 2120cf93b6be39884f951ee2a31c5999.exe File opened (read-only) \??\L: 2120cf93b6be39884f951ee2a31c5999.exe File opened (read-only) \??\O: 2120cf93b6be39884f951ee2a31c5999.exe File opened (read-only) \??\U: 2120cf93b6be39884f951ee2a31c5999.exe File opened (read-only) \??\V: 2120cf93b6be39884f951ee2a31c5999.exe File opened (read-only) \??\Q: 2120cf93b6be39884f951ee2a31c5999.exe File opened (read-only) \??\R: 2120cf93b6be39884f951ee2a31c5999.exe File opened (read-only) \??\S: 2120cf93b6be39884f951ee2a31c5999.exe File opened (read-only) \??\Y: 2120cf93b6be39884f951ee2a31c5999.exe File opened (read-only) \??\F: 2120cf93b6be39884f951ee2a31c5999.exe File opened (read-only) \??\W: 2120cf93b6be39884f951ee2a31c5999.exe File opened (read-only) \??\X: 2120cf93b6be39884f951ee2a31c5999.exe File opened (read-only) \??\Z: 2120cf93b6be39884f951ee2a31c5999.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 616 vssadmin.exe 2924 vssadmin.exe 2204 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe 2432 2120cf93b6be39884f951ee2a31c5999.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeBackupPrivilege 1712 vssvc.exe Token: SeRestorePrivilege 1712 vssvc.exe Token: SeAuditPrivilege 1712 vssvc.exe Token: SeIncreaseQuotaPrivilege 1076 wmic.exe Token: SeSecurityPrivilege 1076 wmic.exe Token: SeTakeOwnershipPrivilege 1076 wmic.exe Token: SeLoadDriverPrivilege 1076 wmic.exe Token: SeSystemProfilePrivilege 1076 wmic.exe Token: SeSystemtimePrivilege 1076 wmic.exe Token: SeProfSingleProcessPrivilege 1076 wmic.exe Token: SeIncBasePriorityPrivilege 1076 wmic.exe Token: SeCreatePagefilePrivilege 1076 wmic.exe Token: SeBackupPrivilege 1076 wmic.exe Token: SeRestorePrivilege 1076 wmic.exe Token: SeShutdownPrivilege 1076 wmic.exe Token: SeDebugPrivilege 1076 wmic.exe Token: SeSystemEnvironmentPrivilege 1076 wmic.exe Token: SeRemoteShutdownPrivilege 1076 wmic.exe Token: SeUndockPrivilege 1076 wmic.exe Token: SeManageVolumePrivilege 1076 wmic.exe Token: 33 1076 wmic.exe Token: 34 1076 wmic.exe Token: 35 1076 wmic.exe Token: SeIncreaseQuotaPrivilege 2848 wmic.exe Token: SeSecurityPrivilege 2848 wmic.exe Token: SeTakeOwnershipPrivilege 2848 wmic.exe Token: SeLoadDriverPrivilege 2848 wmic.exe Token: SeSystemProfilePrivilege 2848 wmic.exe Token: SeSystemtimePrivilege 2848 wmic.exe Token: SeProfSingleProcessPrivilege 2848 wmic.exe Token: SeIncBasePriorityPrivilege 2848 wmic.exe Token: SeCreatePagefilePrivilege 2848 wmic.exe Token: SeBackupPrivilege 2848 wmic.exe Token: SeRestorePrivilege 2848 wmic.exe Token: SeShutdownPrivilege 2848 wmic.exe Token: SeDebugPrivilege 2848 wmic.exe Token: SeSystemEnvironmentPrivilege 2848 wmic.exe Token: SeRemoteShutdownPrivilege 2848 wmic.exe Token: SeUndockPrivilege 2848 wmic.exe Token: SeManageVolumePrivilege 2848 wmic.exe Token: 33 2848 wmic.exe Token: 34 2848 wmic.exe Token: 35 2848 wmic.exe Token: SeIncreaseQuotaPrivilege 2628 wmic.exe Token: SeSecurityPrivilege 2628 wmic.exe Token: SeTakeOwnershipPrivilege 2628 wmic.exe Token: SeLoadDriverPrivilege 2628 wmic.exe Token: SeSystemProfilePrivilege 2628 wmic.exe Token: SeSystemtimePrivilege 2628 wmic.exe Token: SeProfSingleProcessPrivilege 2628 wmic.exe Token: SeIncBasePriorityPrivilege 2628 wmic.exe Token: SeCreatePagefilePrivilege 2628 wmic.exe Token: SeBackupPrivilege 2628 wmic.exe Token: SeRestorePrivilege 2628 wmic.exe Token: SeShutdownPrivilege 2628 wmic.exe Token: SeDebugPrivilege 2628 wmic.exe Token: SeSystemEnvironmentPrivilege 2628 wmic.exe Token: SeRemoteShutdownPrivilege 2628 wmic.exe Token: SeUndockPrivilege 2628 wmic.exe Token: SeManageVolumePrivilege 2628 wmic.exe Token: 33 2628 wmic.exe Token: 34 2628 wmic.exe Token: 35 2628 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2432 wrote to memory of 616 2432 2120cf93b6be39884f951ee2a31c5999.exe 28 PID 2432 wrote to memory of 616 2432 2120cf93b6be39884f951ee2a31c5999.exe 28 PID 2432 wrote to memory of 616 2432 2120cf93b6be39884f951ee2a31c5999.exe 28 PID 2432 wrote to memory of 616 2432 2120cf93b6be39884f951ee2a31c5999.exe 28 PID 2432 wrote to memory of 1076 2432 2120cf93b6be39884f951ee2a31c5999.exe 31 PID 2432 wrote to memory of 1076 2432 2120cf93b6be39884f951ee2a31c5999.exe 31 PID 2432 wrote to memory of 1076 2432 2120cf93b6be39884f951ee2a31c5999.exe 31 PID 2432 wrote to memory of 1076 2432 2120cf93b6be39884f951ee2a31c5999.exe 31 PID 2432 wrote to memory of 2924 2432 2120cf93b6be39884f951ee2a31c5999.exe 33 PID 2432 wrote to memory of 2924 2432 2120cf93b6be39884f951ee2a31c5999.exe 33 PID 2432 wrote to memory of 2924 2432 2120cf93b6be39884f951ee2a31c5999.exe 33 PID 2432 wrote to memory of 2924 2432 2120cf93b6be39884f951ee2a31c5999.exe 33 PID 2432 wrote to memory of 2848 2432 2120cf93b6be39884f951ee2a31c5999.exe 35 PID 2432 wrote to memory of 2848 2432 2120cf93b6be39884f951ee2a31c5999.exe 35 PID 2432 wrote to memory of 2848 2432 2120cf93b6be39884f951ee2a31c5999.exe 35 PID 2432 wrote to memory of 2848 2432 2120cf93b6be39884f951ee2a31c5999.exe 35 PID 2432 wrote to memory of 2204 2432 2120cf93b6be39884f951ee2a31c5999.exe 37 PID 2432 wrote to memory of 2204 2432 2120cf93b6be39884f951ee2a31c5999.exe 37 PID 2432 wrote to memory of 2204 2432 2120cf93b6be39884f951ee2a31c5999.exe 37 PID 2432 wrote to memory of 2204 2432 2120cf93b6be39884f951ee2a31c5999.exe 37 PID 2432 wrote to memory of 2628 2432 2120cf93b6be39884f951ee2a31c5999.exe 39 PID 2432 wrote to memory of 2628 2432 2120cf93b6be39884f951ee2a31c5999.exe 39 PID 2432 wrote to memory of 2628 2432 2120cf93b6be39884f951ee2a31c5999.exe 39 PID 2432 wrote to memory of 2628 2432 2120cf93b6be39884f951ee2a31c5999.exe 39 PID 2596 wrote to memory of 2496 2596 taskeng.exe 46 PID 2596 wrote to memory of 2496 2596 taskeng.exe 46 PID 2596 wrote to memory of 2496 2596 taskeng.exe 46 PID 2596 wrote to memory of 2496 2596 taskeng.exe 46 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2120cf93b6be39884f951ee2a31c5999.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 2120cf93b6be39884f951ee2a31c5999.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 2120cf93b6be39884f951ee2a31c5999.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2120cf93b6be39884f951ee2a31c5999.exe"C:\Users\Admin\AppData\Local\Temp\2120cf93b6be39884f951ee2a31c5999.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2432 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:616
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1076
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:2924
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2848
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:2204
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1712
-
C:\Windows\system32\taskeng.exetaskeng.exe {E310F6C0-3BF0-4262-9BEF-1A1C040A1C50} S-1-5-21-3427588347-1492276948-3422228430-1000:QVMRJQQO\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe2⤵
- Executes dropped EXE
PID:2496
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
669KB
MD52120cf93b6be39884f951ee2a31c5999
SHA1317b695da0ece90979f0400c2c7800e50bec8bb9
SHA256c5bef2a489740192a0b2c34cdc2fd954d0b8d5fabcbe0ecb8b78f9301e5a30a6
SHA5123038b27dcc263675a642f77d9dbaaff921c3a56f160051df44619dbafcd5d108db1c6caeacb70179c511e284035d329f29c34dd19500d2bd4006d2f86ee1dc33
-
Filesize
536B
MD53a4928d74ed244bfc2aad6c7cb49e3df
SHA1da223b86785cc3df669c316ab60b50f489d94016
SHA256181148c75aff9e7176dbd4ded971057280edabf251df728030dbb72362452be4
SHA512afb94544d2acff879ffdf864ad4487792899712131b82a38739841573601e291c250ea1c7b661812ed1ffc5a6bf5279acc6c1911e6919c93085d9510225ee2df
-
Filesize
5KB
MD5c21e4a5be0ea5ffde78f872c39f720e2
SHA11d9209fd675bde427577ad28afb05c70455760e7
SHA2568b39331bc152079f865c185d9f6aa6b1c5fee49e546d6cd56e4fe8f6cc1df567
SHA512e2ef69f5f5edaab18befa46140007e9ca91a507dae3e0d9a46ce86c3acc55217a329bdbddab7a3c07d8db12ca777ef87b362b25bdc2b103f67d04d64cc3b69e6