Analysis
-
max time kernel
152s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14-03-2024 04:08
Static task
static1
Behavioral task
behavioral1
Sample
2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe
Resource
win10v2004-20240226-en
General
-
Target
2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe
-
Size
959KB
-
MD5
2525d5867b27f5ee3949880186c35ed7
-
SHA1
8fc6dd893d10eb3f4d7c06fda1d3e05a8c7ba8ad
-
SHA256
2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695
-
SHA512
589b76ae5cddff763af93164eb817cf971a3a137a7d3a6ad6ac8c3dfcb703c49c13afb69c00d1984edbfeecc63cdefa4a6b78e1c70f6b65fb057e0e82c526376
-
SSDEEP
24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdRF:Ujrc2So1Ff+B3k796r
Malware Config
Extracted
C:\Program Files\Java\jdk1.7.0_80\db\Restore-My-Files.txt
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
https://bigblog.at
http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
https://decoding.at
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 2560 bcdedit.exe 772 bcdedit.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\{DFA4A5C8-6464-BED3-DBE6-DBE4BA8EB71C} = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe\"" 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exedescription ioc process File opened (read-only) \??\F: 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 21 IoCs
Processes:
2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exepid process 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe -
Drops file in Program Files directory 64 IoCs
Processes:
2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exedescription ioc process File opened for modification C:\program files\windows sidebar\gadgets\weather.gadget\ja-jp\css\settings.css 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0341534.jpg 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\na01066_.wmf 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\tr00232_.wmf 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\office14\pubwiz\gift.xml 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\zi\america\bogota 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.runtime_3.10.0.v20140318-2214.jar 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\na02361_.wmf 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\so02094_.wmf 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\office14\1033\grooveforms5\formsstyles\lightspirit.css 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\full\15x15dot.png 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\document themes 14\theme effects\hardcover.eftx 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\office14\forms\1033\rec.cfg 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\clock.gadget\it-it\js\clock.js 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\zi\america\adak 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\visualvm\config\modules\com-sun-tools-visualvm-core.xml 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files\windows sidebar\gadgets\rssfeeds.gadget\de-de\js\rssfeeds.js 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\formsblankpage.html 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\office14\pagesize\pgmn065.xml 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\office14\pubwiz\brchur11.poc 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\rssfeeds.gadget\it-it\gadget.xml 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\adobe\reader 9.0\resource\linguistics\providers\proximity\11.00\brt55.ths 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveprojecttoolset\projecttool\project report type\fancy\hierarchy.js 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\stationery\1033\currency.htm 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\clock.gadget\ja-jp\css\settings.css 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\so00633_.wmf 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\performance\720x480blacksquare.png 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_zh_cn.jar 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files\mozilla firefox\defaults\pref\channel-prefs.js 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files\windows sidebar\gadgets\cpu.gadget\de-de\cpu.html 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0151063.wmf 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\pe02280_.wmf 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\ph01213k.jpg 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\media\office14\bullets\bd14583_.gif 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\textfile.zip 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\rssfeeds.gadget\de-de\css\rssfeeds.css 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64_3.103.1.v20140903-1947.jar 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File created C:\program files\microsoft games\purble place\es-es\Restore-My-Files.txt 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0199469.wmf 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\media\cagcat10\j0240695.wmf 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\swirl\tab_on.gif 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\settings.zip 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files\java\jre7\lib\zi\africa\monrovia 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0099192.gif 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\parnt_08.mid 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\office14\1033\grooveforms5\formsstyles\solutions_doc.css 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\dot.png 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files\java\jre7\lib\zi\america\indiana\vevay 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\office14\1033\pubspapr\zpdir16f.gif 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\lime\tab_off.gif 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\weather.gadget\images\docked_black_rainy.png 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\memories\background.png 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\meta-index 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files\windows sidebar\gadgets\rssfeeds.gadget\it-it\css\settings.css 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\office14\forms\1033\cnfres.cfg 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\office14\pubba\mspub9.bdr 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\fd01659_.wmf 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0200279.wmf 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\cpu.gadget\fr-fr\js\cpu.js 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files (x86)\microsoft office\office14\pubwiz\foldproj.xml 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File created C:\program files\java\jdk1.7.0_80\jre\lib\cmm\Restore-My-Files.txt 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\zi\america\vancouver 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe File created C:\program files\java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\meta-inf\Restore-My-Files.txt 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2640 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exepid process 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exevssvc.exeWMIC.exedescription pid process Token: SeTakeOwnershipPrivilege 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe Token: SeDebugPrivilege 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe Token: SeBackupPrivilege 3060 vssvc.exe Token: SeRestorePrivilege 3060 vssvc.exe Token: SeAuditPrivilege 3060 vssvc.exe Token: SeIncreaseQuotaPrivilege 368 WMIC.exe Token: SeSecurityPrivilege 368 WMIC.exe Token: SeTakeOwnershipPrivilege 368 WMIC.exe Token: SeLoadDriverPrivilege 368 WMIC.exe Token: SeSystemProfilePrivilege 368 WMIC.exe Token: SeSystemtimePrivilege 368 WMIC.exe Token: SeProfSingleProcessPrivilege 368 WMIC.exe Token: SeIncBasePriorityPrivilege 368 WMIC.exe Token: SeCreatePagefilePrivilege 368 WMIC.exe Token: SeBackupPrivilege 368 WMIC.exe Token: SeRestorePrivilege 368 WMIC.exe Token: SeShutdownPrivilege 368 WMIC.exe Token: SeDebugPrivilege 368 WMIC.exe Token: SeSystemEnvironmentPrivilege 368 WMIC.exe Token: SeRemoteShutdownPrivilege 368 WMIC.exe Token: SeUndockPrivilege 368 WMIC.exe Token: SeManageVolumePrivilege 368 WMIC.exe Token: 33 368 WMIC.exe Token: 34 368 WMIC.exe Token: 35 368 WMIC.exe Token: SeIncreaseQuotaPrivilege 368 WMIC.exe Token: SeSecurityPrivilege 368 WMIC.exe Token: SeTakeOwnershipPrivilege 368 WMIC.exe Token: SeLoadDriverPrivilege 368 WMIC.exe Token: SeSystemProfilePrivilege 368 WMIC.exe Token: SeSystemtimePrivilege 368 WMIC.exe Token: SeProfSingleProcessPrivilege 368 WMIC.exe Token: SeIncBasePriorityPrivilege 368 WMIC.exe Token: SeCreatePagefilePrivilege 368 WMIC.exe Token: SeBackupPrivilege 368 WMIC.exe Token: SeRestorePrivilege 368 WMIC.exe Token: SeShutdownPrivilege 368 WMIC.exe Token: SeDebugPrivilege 368 WMIC.exe Token: SeSystemEnvironmentPrivilege 368 WMIC.exe Token: SeRemoteShutdownPrivilege 368 WMIC.exe Token: SeUndockPrivilege 368 WMIC.exe Token: SeManageVolumePrivilege 368 WMIC.exe Token: 33 368 WMIC.exe Token: 34 368 WMIC.exe Token: 35 368 WMIC.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.execmd.exedescription pid process target process PID 1912 wrote to memory of 2644 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe cmd.exe PID 1912 wrote to memory of 2644 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe cmd.exe PID 1912 wrote to memory of 2644 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe cmd.exe PID 1912 wrote to memory of 2644 1912 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe cmd.exe PID 2644 wrote to memory of 2640 2644 cmd.exe vssadmin.exe PID 2644 wrote to memory of 2640 2644 cmd.exe vssadmin.exe PID 2644 wrote to memory of 2640 2644 cmd.exe vssadmin.exe PID 2644 wrote to memory of 368 2644 cmd.exe WMIC.exe PID 2644 wrote to memory of 368 2644 cmd.exe WMIC.exe PID 2644 wrote to memory of 368 2644 cmd.exe WMIC.exe PID 2644 wrote to memory of 2560 2644 cmd.exe bcdedit.exe PID 2644 wrote to memory of 2560 2644 cmd.exe bcdedit.exe PID 2644 wrote to memory of 2560 2644 cmd.exe bcdedit.exe PID 2644 wrote to memory of 772 2644 cmd.exe bcdedit.exe PID 2644 wrote to memory of 772 2644 cmd.exe bcdedit.exe PID 2644 wrote to memory of 772 2644 cmd.exe bcdedit.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe"C:\Users\Admin\AppData\Local\Temp\2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2640 -
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:368 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2560 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:772
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3060
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD5f1cf976bc2e34f3a14088999a4e5188e
SHA1b161683578a161cbf94976bac286e17ebed32d78
SHA256a6bb0101cda4f6ab624e6da6164a98f2bba76d5a7790629da9e3bb6b22c1e87a
SHA51244da6fc58117605c039f5070b5f12d5e171723f63c49983857380b647d81393245265515187cbe6487e136f77222740652f804faeb10a1d21adf5c9c87a8989f