Overview
overview
10Static
static
10075F9A8B9A...C5.exe
windows7-x64
1075F9A8B9A...C5.exe
windows10-2004-x64
1145F7ABE9A...EA.exe
windows7-x64
10145F7ABE9A...EA.exe
windows10-2004-x64
101A99AC759F...31.exe
windows7-x64
31A99AC759F...31.exe
windows10-2004-x64
31BE33E4291...2D.exe
windows7-x64
101BE33E4291...2D.exe
windows10-2004-x64
102188BAE387...0C.dll
windows7-x64
32188BAE387...0C.dll
windows10-2004-x64
322F524ABC9...92.exe
windows7-x64
1022F524ABC9...92.exe
windows10-2004-x64
1033381793BD...5E.exe
windows7-x64
133381793BD...5E.exe
windows10-2004-x64
161C0810A23...A1.exe
windows7-x64
161C0810A23...A1.exe
windows10-2004-x64
1676A2A0D88...CB.exe
windows7-x64
7676A2A0D88...CB.exe
windows10-2004-x64
773D29DEAC4...09.exe
windows7-x64
173D29DEAC4...09.exe
windows10-2004-x64
181EFD50EB3...29.exe
windows7-x64
781EFD50EB3...29.exe
windows10-2004-x64
78E83C0F656...07.exe
windows7-x64
108E83C0F656...07.exe
windows10-2004-x64
1099CA9F3245...E2.exe
windows7-x64
599CA9F3245...E2.exe
windows10-2004-x64
5B1E12D0216...06.exe
windows7-x64
10B1E12D0216...06.exe
windows10-2004-x64
10C6185A23C5...C8.exe
windows7-x64
10C6185A23C5...C8.exe
windows10-2004-x64
10CDCFEDDB0A...3E.exe
windows7-x64
10CDCFEDDB0A...3E.exe
windows10-2004-x64
10Analysis
-
max time kernel
166s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12-01-2024 14:20
Behavioral task
behavioral1
Sample
075F9A8B9A5A3F3C221CFA69BA8B3590CFB873946970B7F3DBD333A580D24AC5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
075F9A8B9A5A3F3C221CFA69BA8B3590CFB873946970B7F3DBD333A580D24AC5.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
145F7ABE9ABFFD0422F1C1F4CF429E89FD9D3BE93E6C3A0DD852DB708992C4EA.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
145F7ABE9ABFFD0422F1C1F4CF429E89FD9D3BE93E6C3A0DD852DB708992C4EA.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
1A99AC759FCD881729B76C2904476B4201E794DF2D0547C954EA37BE7C153131.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
1A99AC759FCD881729B76C2904476B4201E794DF2D0547C954EA37BE7C153131.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
1BE33E42910515D58685E4CEE83C4C9B7DE4E6A155A6FD936922682A9922D42D.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
1BE33E42910515D58685E4CEE83C4C9B7DE4E6A155A6FD936922682A9922D42D.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
2188BAE387FD2665D807D0B67B916973478CBE417D2042A146C8EADF77AF600C.dll
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
2188BAE387FD2665D807D0B67B916973478CBE417D2042A146C8EADF77AF600C.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral11
Sample
22F524ABC98F958705FEBD3761BEDC85EC1AE859316A653B67C0C01327533092.exe
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
22F524ABC98F958705FEBD3761BEDC85EC1AE859316A653B67C0C01327533092.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
33381793BD156716647F2C2E14047AA5559E940FF584D3FF6110B96EB701115E.exe
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
33381793BD156716647F2C2E14047AA5559E940FF584D3FF6110B96EB701115E.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral15
Sample
61C0810A23580CF492A6BA4F7654566108331E7A4134C968C2D6A05261B2D8A1.exe
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
61C0810A23580CF492A6BA4F7654566108331E7A4134C968C2D6A05261B2D8A1.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
676A2A0D88A79012300A63092DA090F5B0D0BDFC105541732254E0AE1FEB2FCB.exe
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
676A2A0D88A79012300A63092DA090F5B0D0BDFC105541732254E0AE1FEB2FCB.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
73D29DEAC41E022CE77730F74D5EFB0828F56D1F2BEB91FD24ABC867F851FE09.exe
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
73D29DEAC41E022CE77730F74D5EFB0828F56D1F2BEB91FD24ABC867F851FE09.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral21
Sample
81EFD50EB374AD2176E2655AF10276079F733C0592E83E3A044253DCBE06F329.exe
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
81EFD50EB374AD2176E2655AF10276079F733C0592E83E3A044253DCBE06F329.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
8E83C0F6566169AF1CF6C28670DCEE6EDEB15D0913AA24AD3831C9F97EB42307.exe
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
8E83C0F6566169AF1CF6C28670DCEE6EDEB15D0913AA24AD3831C9F97EB42307.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral25
Sample
99CA9F3245265C2F9D395B4B3A8554056E481C6FEE98B839C9C5ADB5B79E0DE2.exe
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
99CA9F3245265C2F9D395B4B3A8554056E481C6FEE98B839C9C5ADB5B79E0DE2.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
C6185A23C51B8AC77E6C1BDF2CD4A8D39B02AF8B8027D4162CF9766D19CF87C8.exe
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
C6185A23C51B8AC77E6C1BDF2CD4A8D39B02AF8B8027D4162CF9766D19CF87C8.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
CDCFEDDB0ACA42E65E6A4822C1F23DF7C4AE92775EBCC0B45D4160B732B0983E.exe
Resource
win7-20231215-en
General
-
Target
B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe
-
Size
231KB
-
MD5
5e3ec333a0b2ccf85fcc8ef31c1c8caa
-
SHA1
e6d9b00dd20426fb3d3a2c9a77b86553c144986a
-
SHA256
b1e12d0216a946329fe549e09bf481d7df9e8e3bc3f99bc24d9940cbb8f76f06
-
SHA512
116737b153810a7b2f91e52a03e97fa0601735919ec219aebff5e74321c730d14bbb46f5bcff457587daafd5c8c9341964d1ac91bc171b96f8289e02b0f370f7
-
SSDEEP
3072:ge9f4GwJqzPG927z6r7JGSxS0S4/J2cux2Ut8q7frsFmm0xUMZByH:z9fkgzP4HQSxSuJ2c/AnUmxxUGByH
Malware Config
Extracted
C:\Program Files (x86)\!!!-Restore-My-Files-!!!.txt
lockbit
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion
http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
http://lockbitsupdwon76nzykzblcplixwts4n4zoecugz2bxabtapqvmzqqd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupo7vv5vcl3jxpsdviopwvasljqcstym6efhh6oze7c6xjad.onion
http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion
http://lockbitsupqfyacidr6upt6nhhyipujvaablubuevxj6xy3frthvr3yd.onion
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
https://gdpr.eu/what-is-gdpr/
https://gdpr-info.eu/
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (2349) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s) 27 IoCs
description ioc Process File opened for modification C:\Users\Admin\3D Objects\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\Searches\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Public\Downloads\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Public\Libraries\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Public\Music\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Public\Videos\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Public\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\Videos\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\Documents\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Public\Desktop\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Public\Documents\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\Links\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\Music\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Public\Pictures\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ppd.xrm-ms B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ppd.xrm-ms B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-pl.xrm-ms B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ppd.xrm-ms B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ppd.xrm-ms B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-oob.xrm-ms B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSO0127.ACL B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.181.5\!!!-Restore-My-Files-!!!.txt B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\flavormap.properties B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File created C:\Program Files\Microsoft Office\Updates\!!!-Restore-My-Files-!!!.txt B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\msado26.tlb B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\resources.jar B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Mozilla Firefox\update-settings.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File created C:\Program Files\Microsoft Office\root\Integration\!!!-Restore-My-Files-!!!.txt B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-oob.xrm-ms B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-pl.xrm-ms B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\java.policy B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ppd.xrm-ms B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-pl.xrm-ms B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-phn.xrm-ms B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\sound.properties B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File created C:\Program Files\Internet Explorer\es-ES\!!!-Restore-My-Files-!!!.txt B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\!!!-Restore-My-Files-!!!.txt B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\!!!-Restore-My-Files-!!!.txt B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\VSTOFiles.cat B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-phn.xrm-ms B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-oob.xrm-ms B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.VisualElementsManifest.xml B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Grayscale.xml B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-140.png B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\WindowsApps B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File created C:\Program Files\Google\Chrome\Application\!!!-Restore-My-Files-!!!.txt B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-oob.xrm-ms B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-pl.xrm-ms B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ppd.xrm-ms B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-phn.xrm-ms B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.0 (x64).swidtag B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-phn.xrm-ms B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\icu_web.md B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2String.XSL B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ul-oob.xrm-ms B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Retrospect.thmx B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-80.png B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File created C:\Program Files (x86)\Internet Explorer\!!!-Restore-My-Files-!!!.txt B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeBackupPrivilege 4636 vssvc.exe Token: SeRestorePrivilege 4636 vssvc.exe Token: SeAuditPrivilege 4636 vssvc.exe Token: SeIncreaseQuotaPrivilege 2548 WMIC.exe Token: SeSecurityPrivilege 2548 WMIC.exe Token: SeTakeOwnershipPrivilege 2548 WMIC.exe Token: SeLoadDriverPrivilege 2548 WMIC.exe Token: SeSystemProfilePrivilege 2548 WMIC.exe Token: SeSystemtimePrivilege 2548 WMIC.exe Token: SeProfSingleProcessPrivilege 2548 WMIC.exe Token: SeIncBasePriorityPrivilege 2548 WMIC.exe Token: SeCreatePagefilePrivilege 2548 WMIC.exe Token: SeBackupPrivilege 2548 WMIC.exe Token: SeRestorePrivilege 2548 WMIC.exe Token: SeShutdownPrivilege 2548 WMIC.exe Token: SeDebugPrivilege 2548 WMIC.exe Token: SeSystemEnvironmentPrivilege 2548 WMIC.exe Token: SeRemoteShutdownPrivilege 2548 WMIC.exe Token: SeUndockPrivilege 2548 WMIC.exe Token: SeManageVolumePrivilege 2548 WMIC.exe Token: 33 2548 WMIC.exe Token: 34 2548 WMIC.exe Token: 35 2548 WMIC.exe Token: 36 2548 WMIC.exe Token: SeIncreaseQuotaPrivilege 2548 WMIC.exe Token: SeSecurityPrivilege 2548 WMIC.exe Token: SeTakeOwnershipPrivilege 2548 WMIC.exe Token: SeLoadDriverPrivilege 2548 WMIC.exe Token: SeSystemProfilePrivilege 2548 WMIC.exe Token: SeSystemtimePrivilege 2548 WMIC.exe Token: SeProfSingleProcessPrivilege 2548 WMIC.exe Token: SeIncBasePriorityPrivilege 2548 WMIC.exe Token: SeCreatePagefilePrivilege 2548 WMIC.exe Token: SeBackupPrivilege 2548 WMIC.exe Token: SeRestorePrivilege 2548 WMIC.exe Token: SeShutdownPrivilege 2548 WMIC.exe Token: SeDebugPrivilege 2548 WMIC.exe Token: SeSystemEnvironmentPrivilege 2548 WMIC.exe Token: SeRemoteShutdownPrivilege 2548 WMIC.exe Token: SeUndockPrivilege 2548 WMIC.exe Token: SeManageVolumePrivilege 2548 WMIC.exe Token: 33 2548 WMIC.exe Token: 34 2548 WMIC.exe Token: 35 2548 WMIC.exe Token: 36 2548 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4428 wrote to memory of 60 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 96 PID 4428 wrote to memory of 60 4428 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 96 PID 60 wrote to memory of 2548 60 cmd.exe 99 PID 60 wrote to memory of 2548 60 cmd.exe 99 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe"C:\Users\Admin\AppData\Local\Temp\B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{75FBAB0D-70FA-43FA-8B34-BED6C97A1B82}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{75FBAB0D-70FA-43FA-8B34-BED6C97A1B82}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2548
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4636
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD598f3e62217ca5f8f11449407da8d074c
SHA1dd08305fac9b0d7207f20006726d920b1ae48ad7
SHA256d83cb12dc20ce9cd2018708fba2c370fd76fa6fc2c5ea948b94011ee3965af79
SHA51247d8bf1db1b3989707a8a3c9b0a0b4c9ca1b01af6bf7224e3abb8ed5618c9e91feafb9a92bd32e08e6efae154439399ea10b1874ba188d143963365a571c2bd3