Analysis
-
max time kernel
71s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14-03-2024 04:08
Static task
static1
Behavioral task
behavioral1
Sample
2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe
Resource
win10v2004-20240226-en
General
-
Target
2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe
-
Size
959KB
-
MD5
9dbb0838eb857c2cf22ca5407d6c85d7
-
SHA1
fe486f8741f2f94fc79def45b4872030e5504d3a
-
SHA256
2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495
-
SHA512
1abacf15c959e3f31e54385de34ecec00291aa2dec2e00d663939edf93ff975a1303d579de1d89d00cf557e2e2984862e993ab05f1e0b125eb93d01d5618f417
-
SSDEEP
24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdMF:Ujrc2So1Ff+B3k796u
Malware Config
Extracted
C:\Program Files\Java\jdk1.7.0_80\db\Restore-My-Files.txt
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
https://bigblog.at
http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
https://decoding.at
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 3048 bcdedit.exe 2800 bcdedit.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\{B6BBAC74-BFBF-7719-358C-353603CF0C0E} = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe\"" 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exedescription ioc process File opened (read-only) \??\F: 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 21 IoCs
Processes:
2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exepid process 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe -
Drops file in Program Files directory 64 IoCs
Processes:
2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exedescription ioc process File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerconstraints.exsd 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\java\jre7\lib\security\us_export_policy.jar 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files (x86)\microsoft office\office14\1033\pubspapr\pdir25f.gif 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\javafx.properties 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services_1.1.0.v20140328-1925.jar 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_ja_4.4.0.v20140623020002.jar 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File created C:\program files\java\jre7\lib\zi\asia\Restore-My-Files.txt 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\java\jre7\lib\zi\europe\paris 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\wb01268_.gif 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\whirl2.wmf 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\microsoft games\multiplayer\backgammon\de-de\bckgres.dll.mui 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms5\rtf_center.gif 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\meta-inf\manifest.mf 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator_1.1.0.v20131217-1203.jar 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-services.xml 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\visualvm\config\modules\org-openide-options.xml_hidden 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\windows sidebar\gadgets\calendar.gadget\images\rings-dock.png 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0199469.wmf 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files (x86)\microsoft office\office14\1033\winword_k_col.hxk 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\sports\sportsmaintoscenesbackground_pal.wmv 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_zh_cn.jar 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\microsoft games\solitaire\fr-fr\solitaire.exe.mui 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0105320.wmf 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files (x86)\microsoft office\office14\outlookautodiscover\yahoo.co.kr.xml 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\circle_selectionsubpicturea.png 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\java\jre7\lib\zi\antarctica\davis 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0105376.wmf 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\so02791_.wmf 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files (x86)\microsoft office\media\office14\bullets\bd14866_.gif 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files (x86)\microsoft office\office14\1033\pubspapr\pdir22f.gif 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\7-zip\lang\pt-br.txt 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File created C:\program files\java\jdk1.7.0_80\jre\lib\security\Restore-My-Files.txt 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files (x86)\microsoft office\office14\pubwiz\weblink.poc 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\weather.gadget\it-it\js\localizedstrings.js 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\babyboy\babyboynotesbackground_pal.wmv 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\babyboy\babyboyscenesbackground.wmv 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\zi\america\detroit 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\java\jre7\lib\zi\asia\baku 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\videolan\vlc\locale\fr\lc_messages\vlc.mo 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File created C:\program files\videolan\vlc\locale\zh_cn\lc_messages\Restore-My-Files.txt 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files (x86)\microsoft office\media\office14\bullets\bd10335_.gif 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\videolan\vlc\locale\et\lc_messages\vlc.mo 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\na01154_.wmf 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable_1.4.1.v20140210-1835.jar 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\java\jre7\lib\zi\asia\dili 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\windows sidebar\gadgets\calendar.gadget\images\corner.png 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files (x86)\microsoft office\document themes 14\theme colors\urban.xml 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\zi\asia\makassar 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\java\jre7\lib\zi\america\havana 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\windows sidebar\gadgets\currency.gadget\en-us\css\currency.css 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\windows sidebar\gadgets\mediacenter.gadget\settings.html 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files (x86)\adobe\reader 9.0\reader\tracker\trash.gif 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\na01149_.wmf 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\oldage\navigationup_buttongraphic.png 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\sports\previousmenubuttonicon.png 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\windows sidebar\gadgets\weather.gadget\images\7.png 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files (x86)\microsoft office\media\office14\bullets\bd21316_.gif 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File created C:\program files (x86)\microsoft office\office14\accwiz\Restore-My-Files.txt 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files (x86)\microsoft office\office14\pubwiz\fs3box.poc 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files (x86)\microsoft office\office14\pubwiz\signhm.poc 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\clock.gadget\images\modern_settings.png 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\oldage\navigationright_buttongraphic.png 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_ja_4.4.0.v20140623020002.jar 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1148 1936 WerFault.exe 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2780 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exepid process 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exevssvc.exeWMIC.exedescription pid process Token: SeTakeOwnershipPrivilege 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe Token: SeDebugPrivilege 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe Token: SeBackupPrivilege 1652 vssvc.exe Token: SeRestorePrivilege 1652 vssvc.exe Token: SeAuditPrivilege 1652 vssvc.exe Token: SeIncreaseQuotaPrivilege 1644 WMIC.exe Token: SeSecurityPrivilege 1644 WMIC.exe Token: SeTakeOwnershipPrivilege 1644 WMIC.exe Token: SeLoadDriverPrivilege 1644 WMIC.exe Token: SeSystemProfilePrivilege 1644 WMIC.exe Token: SeSystemtimePrivilege 1644 WMIC.exe Token: SeProfSingleProcessPrivilege 1644 WMIC.exe Token: SeIncBasePriorityPrivilege 1644 WMIC.exe Token: SeCreatePagefilePrivilege 1644 WMIC.exe Token: SeBackupPrivilege 1644 WMIC.exe Token: SeRestorePrivilege 1644 WMIC.exe Token: SeShutdownPrivilege 1644 WMIC.exe Token: SeDebugPrivilege 1644 WMIC.exe Token: SeSystemEnvironmentPrivilege 1644 WMIC.exe Token: SeRemoteShutdownPrivilege 1644 WMIC.exe Token: SeUndockPrivilege 1644 WMIC.exe Token: SeManageVolumePrivilege 1644 WMIC.exe Token: 33 1644 WMIC.exe Token: 34 1644 WMIC.exe Token: 35 1644 WMIC.exe Token: SeIncreaseQuotaPrivilege 1644 WMIC.exe Token: SeSecurityPrivilege 1644 WMIC.exe Token: SeTakeOwnershipPrivilege 1644 WMIC.exe Token: SeLoadDriverPrivilege 1644 WMIC.exe Token: SeSystemProfilePrivilege 1644 WMIC.exe Token: SeSystemtimePrivilege 1644 WMIC.exe Token: SeProfSingleProcessPrivilege 1644 WMIC.exe Token: SeIncBasePriorityPrivilege 1644 WMIC.exe Token: SeCreatePagefilePrivilege 1644 WMIC.exe Token: SeBackupPrivilege 1644 WMIC.exe Token: SeRestorePrivilege 1644 WMIC.exe Token: SeShutdownPrivilege 1644 WMIC.exe Token: SeDebugPrivilege 1644 WMIC.exe Token: SeSystemEnvironmentPrivilege 1644 WMIC.exe Token: SeRemoteShutdownPrivilege 1644 WMIC.exe Token: SeUndockPrivilege 1644 WMIC.exe Token: SeManageVolumePrivilege 1644 WMIC.exe Token: 33 1644 WMIC.exe Token: 34 1644 WMIC.exe Token: 35 1644 WMIC.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.execmd.exedescription pid process target process PID 1936 wrote to memory of 1880 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe cmd.exe PID 1936 wrote to memory of 1880 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe cmd.exe PID 1936 wrote to memory of 1880 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe cmd.exe PID 1936 wrote to memory of 1880 1936 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe cmd.exe PID 1880 wrote to memory of 2780 1880 cmd.exe vssadmin.exe PID 1880 wrote to memory of 2780 1880 cmd.exe vssadmin.exe PID 1880 wrote to memory of 2780 1880 cmd.exe vssadmin.exe PID 1880 wrote to memory of 1644 1880 cmd.exe WMIC.exe PID 1880 wrote to memory of 1644 1880 cmd.exe WMIC.exe PID 1880 wrote to memory of 1644 1880 cmd.exe WMIC.exe PID 1880 wrote to memory of 3048 1880 cmd.exe bcdedit.exe PID 1880 wrote to memory of 3048 1880 cmd.exe bcdedit.exe PID 1880 wrote to memory of 3048 1880 cmd.exe bcdedit.exe PID 1880 wrote to memory of 2800 1880 cmd.exe bcdedit.exe PID 1880 wrote to memory of 2800 1880 cmd.exe bcdedit.exe PID 1880 wrote to memory of 2800 1880 cmd.exe bcdedit.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe"C:\Users\Admin\AppData\Local\Temp\2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2780 -
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1644 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:3048 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2800 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 30122⤵
- Program crash
PID:1148
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1652
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD5c9de4e81027e4da15a61a5f1eb3b6d93
SHA1f4053c9416e40455161ed225ef6143d6e8642db6
SHA25656202148b0864ebaa23fcb8f8b5562932dd2a2284bd5ab5704caa1070884f55f
SHA51276ed7cf2b6d9670650af9d06480140dde97ba149c569940b5984ed66afa040b523b9bcd0b4220b9d3bea1b0d2261ec9aed2c981ef6741e8b3d2e58da365c4585