ee65e9d7a7bc9d17e894e0b775fc0bbfb35e72c65c3d768e34bfe059d521cc16

Resubmissions

21-01-2024 14:52

240121-r8syqaeac7 10

21-01-2024 14:51

240121-r8k8waeac5 10

01-01-2024 13:55

240101-q776kscacp 10

Analysis

max time kernel
129s
max time network
22s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 13:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
Size

450KB
MD5

e70b33103c17c000ac11025d2d8e70a1
SHA1

df898d9d0e8e6f2d4eb5d4742d4c206092cdcb34
SHA256

365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7
SHA512

632461a9c6bff4e013cf3e77a7262d1daaa8775156c61c70dab685ae59114b22d00a47a0214204f6c514c6be77ad5b0c371a889076072fdb1eaf574cb6d4c42c
SSDEEP

12288:krYn2GbqdcOuAKi1kcwyEOywAx1gT+yFCv6oE4E:kcNbqdFtVkcwyEOix1GtFCv6F4E

Score

9^/10

ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (8412) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1760 cmd.exe

pid	process
1760	cmd.exe

Drops desktop.ini file(s) 40 IoCs

Processes:

365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1268429524-3929314613-1992311491-1000\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1268429524-3929314613-1992311491-1000\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe

Drops file in Program Files directory 64 IoCs

Processes:

365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0216516.WMF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGLOGO.DPV	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\readme.txt	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Apex.xml	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\currency.css	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\readme.txt	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0214934.WMF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\readme.txt	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047x576black.png	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\calendar.css	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01080_.WMF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0305493.WMF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21326_.GIF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File created	C:\Program Files\Microsoft Games\Mahjong\de-DE\readme.txt	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105530.WMF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding_1.4.2.v20140729-1044.jar	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101859.BMP	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\ContactSelector.ico	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\readme.txt	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+12	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\readme.txt	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_ja.jar	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\19.png	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\DVD Maker\offset.ax	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4_1.0.800.v20140827-1444.jar	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\readme.txt	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ADD.GIF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\vlc.mo	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Vilnius	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0295069.WMF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0186002.WMF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue.css	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSTINTL.DLL	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01063_.WMF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\readme.txt	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_OFF.GIF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CATWIZ11.POC	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\logger\readme.txt	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7MDT	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\vlc.mo	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\jni.h	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Fakaofo	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152894.WMF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199469.WMF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Aspect.thmx	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Swift_Current	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Kamchatka	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext.png	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\PREVIEW.GIF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10308_.GIF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR18F.GIF	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2932 timeout.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2664 vssadmin.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe

pid process

2476 365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 1372 vssvc.exe
Token: SeRestorePrivilege 1372 vssvc.exe
Token: SeAuditPrivilege 1372 vssvc.exe

pid	process
2932	timeout.exe

pid	process
2664	vssadmin.exe

pid	process
2476	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe

description	pid	process
Token: SeBackupPrivilege	1372	vssvc.exe
Token: SeRestorePrivilege	1372	vssvc.exe
Token: SeAuditPrivilege	1372	vssvc.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.execmd.exe

description	pid	process	target process
PID 2476 wrote to memory of 2664	2476	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe	vssadmin.exe
PID 2476 wrote to memory of 2664	2476	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe	vssadmin.exe
PID 2476 wrote to memory of 2664	2476	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe	vssadmin.exe
PID 2476 wrote to memory of 2664	2476	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe	vssadmin.exe
PID 2476 wrote to memory of 1760	2476	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe	cmd.exe
PID 2476 wrote to memory of 1760	2476	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe	cmd.exe
PID 2476 wrote to memory of 1760	2476	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe	cmd.exe
PID 2476 wrote to memory of 1760	2476	365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe	cmd.exe
PID 1760 wrote to memory of 2932	1760	cmd.exe	timeout.exe
PID 1760 wrote to memory of 2932	1760	cmd.exe	timeout.exe
PID 1760 wrote to memory of 2932	1760	cmd.exe	timeout.exe
PID 1760 wrote to memory of 2932	1760	cmd.exe	timeout.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe
"C:\Users\Admin\AppData\Local\Temp\365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:2664
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c timeout 1 && del "C:\Users\Admin\AppData\Local\Temp\365712147d687fb2eb2d5cb612586c7d3d7364277441491a3ab379a4a1128ba7.exe" >> NUL
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2932

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1268429524-3929314613-1992311491-1000\desktop.ini

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2476-3397-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2476-5-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2476-3399-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2476-6-0x0000000000220000-0x0000000000260000-memory.dmp

Filesize
256KB

Download
memory/2476-3400-0x0000000000310000-0x0000000000390000-memory.dmp

Filesize
512KB

Download
memory/2476-1-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2476-3-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2476-6577-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2476-7-0x0000000000220000-0x0000000000260000-memory.dmp

Filesize
256KB

Download
memory/2476-4-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2476-2-0x0000000000310000-0x0000000000390000-memory.dmp

Filesize
512KB

Download
memory/2476-12561-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2476-14575-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2476-14852-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2476-17056-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/2476-18926-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2476-18927-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download