Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
86s -
max time network
142s -
platform
windows11-21h2_x64 -
resource
win11-20231222-en -
resource tags
arch:x64arch:x86image:win11-20231222-enlocale:en-usos:windows11-21h2-x64system -
submitted
22/01/2024, 15:47
Behavioral task
behavioral1
Sample
3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe
Resource
win10-20231215-en
Behavioral task
behavioral3
Sample
3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral4
Sample
3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe
Resource
win11-20231222-en
General
-
Target
3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe
-
Size
34KB
-
MD5
5bcf1a6a65d8d0d2ad1c2a78935322b5
-
SHA1
c5af15f8170e3840ba756397cb1548fa9489fae9
-
SHA256
3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e
-
SHA512
f21e3bc29b60d3ed248dd048774823d013beb43f2fcf7e560774f1987dc07ff42de2fb68a8dd3bad0653a8587cca9b9f18e0671342c81d8c5698b97a135eb639
-
SSDEEP
768:24HLd8Vdh1qV1Esg8kdJCzSIZHkKRV6kNDB3eHkkb/u:2Q8VgV1U8ZGURVFB3eH/u
Malware Config
Extracted
C:\Program Files\Common Files\DESIGNER\readme-warning.txt
makop
Signatures
-
Makop
Ransomware family discovered by @VK_Intel in early 2020.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (8410) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 3904 wbadmin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pt-br\readme-warning.txt 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\PeopleAppList.targetsize-16.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\readme-warning.txt 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-white\PowerAutomateWide310x150Logo.scale-100.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_checkbox_unselected_18.svg 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ca-es\readme-warning.txt 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\readme-warning.txt 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-si\readme-warning.txt 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\NewsAppList.targetsize-32_altform-lightunplated_contrast-black.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\GetHelpAppList.scale-100_contrast-white.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-72_altform-unplated.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\FeedbackHubAppList.targetsize-24.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\DetailsList\DetailsRowFields.js 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_nb_135x40.svg 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-phn.xrm-ms 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\EmptySearch.scale-125.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Office365LogoWLockup.scale-180.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-white\NotepadAppList.scale-400.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\Locales\gd.pak.DATA 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.tlb 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER.XLAM 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PaintAppList.targetsize-40.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon_hover.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ppd.xrm-ms 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-72_altform-unplated.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\Assets\Icons\StickyNotesAppList.targetsize-24_altform-unplated_contrast-black.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-40_altform-lightunplated.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-GoogleCloudCache.scale-125.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxWideTile.scale-125.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\ResiliencyLinks\Locales\mi.pak.DATA 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-oob.xrm-ms 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-30_altform-lightunplated_contrast-black.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Doughboy.scale-400.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\core_icons.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_hover.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt\msipc.dll.mui 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\Rating.js 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymb.ttf 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptyCalendarSearch.scale-200.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SnipSketchAppList.targetsize-256.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\contrast-white\CameraAppList.scale-100.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-48_altform-unplated_contrast-black.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderStoreLogo.scale-200_contrast-black.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-64_altform-unplated_contrast-black.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Sigma\Other.DATA 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\PREVIEW.GIF 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\Square44x44Logo.targetsize-64_altform-unplated_contrast-black.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\Callout.js 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\customizations\customizable.js 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_gridview.svg 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\readme-warning.txt 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-24_contrast-black.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\FeedbackHubAppList.targetsize-16_altform-lightunplated.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_browser.gif 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\VisualElements\Logo.png.DATA 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-60.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\mobileDetector.js 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\vlc.mo 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\bg_pattern_RHP.png 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe -
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1960 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4584 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe 4584 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeBackupPrivilege 5116 vssvc.exe Token: SeRestorePrivilege 5116 vssvc.exe Token: SeAuditPrivilege 5116 vssvc.exe Token: SeBackupPrivilege 440 wbengine.exe Token: SeRestorePrivilege 440 wbengine.exe Token: SeSecurityPrivilege 440 wbengine.exe Token: SeIncreaseQuotaPrivilege 3556 WMIC.exe Token: SeSecurityPrivilege 3556 WMIC.exe Token: SeTakeOwnershipPrivilege 3556 WMIC.exe Token: SeLoadDriverPrivilege 3556 WMIC.exe Token: SeSystemProfilePrivilege 3556 WMIC.exe Token: SeSystemtimePrivilege 3556 WMIC.exe Token: SeProfSingleProcessPrivilege 3556 WMIC.exe Token: SeIncBasePriorityPrivilege 3556 WMIC.exe Token: SeCreatePagefilePrivilege 3556 WMIC.exe Token: SeBackupPrivilege 3556 WMIC.exe Token: SeRestorePrivilege 3556 WMIC.exe Token: SeShutdownPrivilege 3556 WMIC.exe Token: SeDebugPrivilege 3556 WMIC.exe Token: SeSystemEnvironmentPrivilege 3556 WMIC.exe Token: SeRemoteShutdownPrivilege 3556 WMIC.exe Token: SeUndockPrivilege 3556 WMIC.exe Token: SeManageVolumePrivilege 3556 WMIC.exe Token: 33 3556 WMIC.exe Token: 34 3556 WMIC.exe Token: 35 3556 WMIC.exe Token: 36 3556 WMIC.exe Token: SeIncreaseQuotaPrivilege 3556 WMIC.exe Token: SeSecurityPrivilege 3556 WMIC.exe Token: SeTakeOwnershipPrivilege 3556 WMIC.exe Token: SeLoadDriverPrivilege 3556 WMIC.exe Token: SeSystemProfilePrivilege 3556 WMIC.exe Token: SeSystemtimePrivilege 3556 WMIC.exe Token: SeProfSingleProcessPrivilege 3556 WMIC.exe Token: SeIncBasePriorityPrivilege 3556 WMIC.exe Token: SeCreatePagefilePrivilege 3556 WMIC.exe Token: SeBackupPrivilege 3556 WMIC.exe Token: SeRestorePrivilege 3556 WMIC.exe Token: SeShutdownPrivilege 3556 WMIC.exe Token: SeDebugPrivilege 3556 WMIC.exe Token: SeSystemEnvironmentPrivilege 3556 WMIC.exe Token: SeRemoteShutdownPrivilege 3556 WMIC.exe Token: SeUndockPrivilege 3556 WMIC.exe Token: SeManageVolumePrivilege 3556 WMIC.exe Token: 33 3556 WMIC.exe Token: 34 3556 WMIC.exe Token: 35 3556 WMIC.exe Token: 36 3556 WMIC.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4584 wrote to memory of 1192 4584 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe 82 PID 4584 wrote to memory of 1192 4584 3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe 82 PID 1192 wrote to memory of 1960 1192 cmd.exe 84 PID 1192 wrote to memory of 1960 1192 cmd.exe 84 PID 1192 wrote to memory of 3904 1192 cmd.exe 87 PID 1192 wrote to memory of 3904 1192 cmd.exe 87 PID 1192 wrote to memory of 3556 1192 cmd.exe 91 PID 1192 wrote to memory of 3556 1192 cmd.exe 91 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe"C:\Users\Admin\AppData\Local\Temp\3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe"C:\Users\Admin\AppData\Local\Temp\3b15b66bf6a7d7ebab6437906686037f23a797d15e0fbff3d6741d3f58db8f1e.exe" n45842⤵PID:5036
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1960
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:3904
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3556
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5116
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:440
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1440
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:976
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD577a68ff56146027e479d7fb6c84c4aa4
SHA1d58ca47125ce00bf752bd66c378ace3559b98689
SHA256fb25fd1761c66f21136889ce4f5a15c84e60e47e26595ae1b77f5f4f63d95f7f
SHA512f47b954833905f6e6d17f98d882f460c7fd73e47efd48a9ddd01a16410c0754d240dab6fc45ae0afa3516f9dea24895619fdcbd96e232c5c3347e23fe485830e