Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
125s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/01/2024, 15:47
Behavioral task
behavioral1
Sample
3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe
Resource
win10-20231215-en
Behavioral task
behavioral3
Sample
3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral4
Sample
3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe
Resource
win11-20231222-en
General
-
Target
3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe
-
Size
34KB
-
MD5
5bcf1a6a65d8d0d2ad1c2a78935322b5
-
SHA1
c5af15f8170e3840ba756397cb1548fa9489fae9
-
SHA256
3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e
-
SHA512
f21e3bc29b60d3ed248dd048774823d013beb43f2fcf7e560774f1987dc07ff42de2fb68a8dd3bad0653a8587cca9b9f18e0671342c81d8c5698b97a135eb639
-
SSDEEP
768:24HLd8Vdh1qV1Esg8kdJCzSIZHkKRV6kNDB3eHkkb/u:2Q8VgV1U8ZGURVFB3eH/u
Malware Config
Extracted
C:\odt\readme-warning.txt
makop
Signatures
-
Makop
Ransomware family discovered by @VK_Intel in early 2020.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (7990) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 1648 wbadmin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-pl.xrm-ms 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul.xrm-ms 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK\PREVIEW.GIF 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Library\EUROTOOL.XLAM 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\VBLR6.CHM 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.scale-200.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Call_Ringback.m4a 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nb-no\readme-warning.txt 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_altform-unplated_contrast-white.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\TXP_Flight.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\ui-strings.js 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\eu-es\ui-strings.js 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Resources.pri 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Windows Defender\ja-JP\EppManifest.dll.mui 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailLargeTile.scale-400.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\AppxManifest.xml 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\rhp\editpdf-selector.js 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\id-ID\View3d\3DViewerProductDescription-universal.xml 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sign-in-2x.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ppd.xrm-ms 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreAppList.targetsize-48.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256_altform-unplated_devicefamily-colorfulunplated.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\IA32.api 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightRegular.ttf 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul-oob.xrm-ms 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\VideoLAN\VLC\Documentation.url 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeMedTile.scale-125_contrast-black.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-black_scale-200.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-100_contrast-white.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MediumTile.scale-200_contrast-black.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\readme-warning.txt 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\Classic\TriPeaks.Large.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_contrast-white.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailMediumTile.scale-400.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubLargeTile.scale-200_contrast-white.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ca-es\ui-strings.js 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\uk-ua\ui-strings.js 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-80.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\29.jpg 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-30_altform-unplated.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-400_contrast-black.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-il\readme-warning.txt 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File created C:\Program Files (x86)\Microsoft\Edge\readme-warning.txt 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsSplashScreen.scale-125.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeBadge.scale-150.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\exportpdfupsell-app-selector.js 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hu-hu\readme-warning.txt 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul-oob.xrm-ms 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\agavedefaulticon96x96.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-400_contrast-white.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\multi-tab-file-view-2x.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe.sig 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-phn.xrm-ms 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-40_contrast-white.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe -
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 312 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 228 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe 228 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeBackupPrivilege 2188 vssvc.exe Token: SeRestorePrivilege 2188 vssvc.exe Token: SeAuditPrivilege 2188 vssvc.exe Token: SeBackupPrivilege 1084 wbengine.exe Token: SeRestorePrivilege 1084 wbengine.exe Token: SeSecurityPrivilege 1084 wbengine.exe Token: SeIncreaseQuotaPrivilege 4548 WMIC.exe Token: SeSecurityPrivilege 4548 WMIC.exe Token: SeTakeOwnershipPrivilege 4548 WMIC.exe Token: SeLoadDriverPrivilege 4548 WMIC.exe Token: SeSystemProfilePrivilege 4548 WMIC.exe Token: SeSystemtimePrivilege 4548 WMIC.exe Token: SeProfSingleProcessPrivilege 4548 WMIC.exe Token: SeIncBasePriorityPrivilege 4548 WMIC.exe Token: SeCreatePagefilePrivilege 4548 WMIC.exe Token: SeBackupPrivilege 4548 WMIC.exe Token: SeRestorePrivilege 4548 WMIC.exe Token: SeShutdownPrivilege 4548 WMIC.exe Token: SeDebugPrivilege 4548 WMIC.exe Token: SeSystemEnvironmentPrivilege 4548 WMIC.exe Token: SeRemoteShutdownPrivilege 4548 WMIC.exe Token: SeUndockPrivilege 4548 WMIC.exe Token: SeManageVolumePrivilege 4548 WMIC.exe Token: 33 4548 WMIC.exe Token: 34 4548 WMIC.exe Token: 35 4548 WMIC.exe Token: 36 4548 WMIC.exe Token: SeIncreaseQuotaPrivilege 4548 WMIC.exe Token: SeSecurityPrivilege 4548 WMIC.exe Token: SeTakeOwnershipPrivilege 4548 WMIC.exe Token: SeLoadDriverPrivilege 4548 WMIC.exe Token: SeSystemProfilePrivilege 4548 WMIC.exe Token: SeSystemtimePrivilege 4548 WMIC.exe Token: SeProfSingleProcessPrivilege 4548 WMIC.exe Token: SeIncBasePriorityPrivilege 4548 WMIC.exe Token: SeCreatePagefilePrivilege 4548 WMIC.exe Token: SeBackupPrivilege 4548 WMIC.exe Token: SeRestorePrivilege 4548 WMIC.exe Token: SeShutdownPrivilege 4548 WMIC.exe Token: SeDebugPrivilege 4548 WMIC.exe Token: SeSystemEnvironmentPrivilege 4548 WMIC.exe Token: SeRemoteShutdownPrivilege 4548 WMIC.exe Token: SeUndockPrivilege 4548 WMIC.exe Token: SeManageVolumePrivilege 4548 WMIC.exe Token: 33 4548 WMIC.exe Token: 34 4548 WMIC.exe Token: 35 4548 WMIC.exe Token: 36 4548 WMIC.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 228 wrote to memory of 1400 228 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe 89 PID 228 wrote to memory of 1400 228 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe 89 PID 1400 wrote to memory of 312 1400 cmd.exe 91 PID 1400 wrote to memory of 312 1400 cmd.exe 91 PID 1400 wrote to memory of 1648 1400 cmd.exe 95 PID 1400 wrote to memory of 1648 1400 cmd.exe 95 PID 1400 wrote to memory of 4548 1400 cmd.exe 99 PID 1400 wrote to memory of 4548 1400 cmd.exe 99 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe"C:\Users\Admin\AppData\Local\Temp\3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe"C:\Users\Admin\AppData\Local\Temp\3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe" n2282⤵PID:4860
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:312
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:1648
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4548
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2188
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1084
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:4892
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:3324
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD577a68ff56146027e479d7fb6c84c4aa4
SHA1d58ca47125ce00bf752bd66c378ace3559b98689
SHA256fb25fd1761c66f21136889ce4f5a15c84e60e47e26595ae1b77f5f4f63d95f7f
SHA512f47b954833905f6e6d17f98d882f460c7fd73e47efd48a9ddd01a16410c0754d240dab6fc45ae0afa3516f9dea24895619fdcbd96e232c5c3347e23fe485830e