Analysis
-
max time kernel
73s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2024 04:09
Static task
static1
Behavioral task
behavioral1
Sample
2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe
Resource
win10v2004-20240226-en
General
-
Target
2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe
-
Size
959KB
-
MD5
ebd239b8b8fe486b2a13a5896a96d044
-
SHA1
60821226d8d934d488d4f8e8081c32c6a73f8929
-
SHA256
2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735
-
SHA512
2bd55c0548c3bdccde061098ed314705c131e745c8a7503708f2e8a5c98beb94fb55c7f7a183945c199badcacae37d81e5edc9afd9c802b2778867928e7371f6
-
SSDEEP
24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdHF:Ujrc2So1Ff+B3k7969
Malware Config
Extracted
C:\Program Files\dotnet\Restore-My-Files.txt
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
https://bigblog.at
http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
https://decoding.at
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
OfficeC2RClient.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE is not expected to spawn this process 2132 2316 OfficeC2RClient.exe ONENOTE.EXE -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 376 bcdedit.exe 3148 bcdedit.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{3BD122ED-7171-E448-5821-58494B988FBE} = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe\"" 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exedescription ioc process File opened (read-only) \??\F: 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe -
Drops file in System32 directory 1 IoCs
Processes:
2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exedescription ioc process File created C:\windows\SysWOW64\9ED1D8.ico 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
Processes:
2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exepid process 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe -
Drops file in Program Files directory 64 IoCs
Processes:
2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exedescription ioc process File opened for modification C:\program files\dotnet\shared\microsoft.netcore.app\6.0.25\microsoft.netcore.app.runtimeconfig.json 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File created C:\program files\microsoft office\root\office16\fpa_f4\Restore-My-Files.txt 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\powerpoint2019vl_mak_ae-pl.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\projectproco365r_subscription-ul-oob.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\visioproxc2rvl_kms_clientc2r-ul.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\java\jdk-1.8\jre\lib\deploy\messages_es.properties 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\document themes 16\theme fonts\century schoolbook.xml 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\packagemanifests\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\excelr_retail-ul-oob.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\o365homepremr_subscription5-ul-oob.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\projectproco365r_subtest-ul-oob.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\projectstdvl_kms_client-ul-oob.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\visiopror_retail-pl.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\7-zip\lang\sl.txt 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File created C:\program files\java\jre-1.8\lib\images\cursors\Restore-My-Files.txt 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\java\jdk-1.8\jre\lib\plugin.jar 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\java\jre-1.8\lib\deploy\messages_de.properties 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\visioproxc2rvl_kms_clientc2r-ppd.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\7-zip\lang\ne.txt 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\personal2019demor_bypasstrial180-ppd.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\projectprovl_mak-ul-oob.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\visioproxc2rvl_makc2r-ul-phn.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File created C:\program files\java\jdk-1.8\jre\lib\deploy\Restore-My-Files.txt 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\java\jdk-1.8\jre\lib\jfr.jar 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\office16\library\analysis\atpvbaen.xlam 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\o365propluse5r_subscription-ppd.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\projectstd2019vl_mak_ae-ul-phn.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\java\jre-1.8\lib\tzmappings 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\outlookr_oem_perp-ppd.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\java\jdk-1.8\jre\lib\deploy\[email protected] 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\java\jdk-1.8\jre\lib\management\management.properties 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\java\jdk-1.8\jre\legal\jdk\jcup.md 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\java\jdk-1.8\jre\lib\ext\meta-index 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\powerpointr_grace-ppd.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\powerpointvl_mak-ppd.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\professionalr_oem_perp-ul-phn.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\proplus2019r_oem_perp6-ul-phn.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\word2019r_trial-ul-oob.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\office16\1033\onguide.onepkg 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\java\jre-1.8\lib\images\cursors\invalid32x32.gif 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\document themes 16\theme effects\banded edge.eftx 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\wordr_retail-ul-oob.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\professionalr_retail-ppd.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\visiopromsdnr_retail-pl.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\mondor_trial-pl.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\outlook2019vl_mak_ae-ul-oob.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\professional2019r_prepidbypass-ul-oob.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\publisher2019r_trial-pl.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.25\microsoft.windowsdesktop.app.deps.json 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\java\jdk-1.8\jre\legal\jdk\cryptix.md 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\7-zip\lang\ru.txt 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\o365homepremr_grace-ppd.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\o365smallbuspremr_grace-ul-oob.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\office16\1033\clientlangpack_eula.txt 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\office16\addins\microsoft power query for excel integrated\bin\microsoft.mashup.container.netfx40.exe.config 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\java\jre-1.8\legal\jdk\asm.md 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\o365homepremr_subtest1-ppd.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\proplus2019r_oem_perp3-ul-phn.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\homebusiness2019r_oem_perp4-pl.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\homebusinessr_oem_perp-pl.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\visioproo365r_subtrial-ul-oob.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\proplus2019r_oem_perp-ul-oob.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\microsoft office\root\licenses16\skypeforbusiness2019vl_kms_client_ae-ppd.xrm-ms 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe File opened for modification C:\program files\java\jdk-1.8\license 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 4856 vssadmin.exe -
Modifies registry class 3 IoCs
Processes:
2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lockbit\DefaultIcon\ = "C:\\windows\\SysWow64\\9ED1D8.ico" 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe Key created \Registry\Machine\Software\Classes\.lockbit 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe Key created \Registry\Machine\Software\Classes\.lockbit\DefaultIcon 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exepid process 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
Processes:
2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exevssvc.exeWMIC.exedescription pid process Token: SeTakeOwnershipPrivilege 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe Token: SeDebugPrivilege 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe Token: SeBackupPrivilege 3316 vssvc.exe Token: SeRestorePrivilege 3316 vssvc.exe Token: SeAuditPrivilege 3316 vssvc.exe Token: SeIncreaseQuotaPrivilege 2320 WMIC.exe Token: SeSecurityPrivilege 2320 WMIC.exe Token: SeTakeOwnershipPrivilege 2320 WMIC.exe Token: SeLoadDriverPrivilege 2320 WMIC.exe Token: SeSystemProfilePrivilege 2320 WMIC.exe Token: SeSystemtimePrivilege 2320 WMIC.exe Token: SeProfSingleProcessPrivilege 2320 WMIC.exe Token: SeIncBasePriorityPrivilege 2320 WMIC.exe Token: SeCreatePagefilePrivilege 2320 WMIC.exe Token: SeBackupPrivilege 2320 WMIC.exe Token: SeRestorePrivilege 2320 WMIC.exe Token: SeShutdownPrivilege 2320 WMIC.exe Token: SeDebugPrivilege 2320 WMIC.exe Token: SeSystemEnvironmentPrivilege 2320 WMIC.exe Token: SeRemoteShutdownPrivilege 2320 WMIC.exe Token: SeUndockPrivilege 2320 WMIC.exe Token: SeManageVolumePrivilege 2320 WMIC.exe Token: 33 2320 WMIC.exe Token: 34 2320 WMIC.exe Token: 35 2320 WMIC.exe Token: 36 2320 WMIC.exe Token: SeIncreaseQuotaPrivilege 2320 WMIC.exe Token: SeSecurityPrivilege 2320 WMIC.exe Token: SeTakeOwnershipPrivilege 2320 WMIC.exe Token: SeLoadDriverPrivilege 2320 WMIC.exe Token: SeSystemProfilePrivilege 2320 WMIC.exe Token: SeSystemtimePrivilege 2320 WMIC.exe Token: SeProfSingleProcessPrivilege 2320 WMIC.exe Token: SeIncBasePriorityPrivilege 2320 WMIC.exe Token: SeCreatePagefilePrivilege 2320 WMIC.exe Token: SeBackupPrivilege 2320 WMIC.exe Token: SeRestorePrivilege 2320 WMIC.exe Token: SeShutdownPrivilege 2320 WMIC.exe Token: SeDebugPrivilege 2320 WMIC.exe Token: SeSystemEnvironmentPrivilege 2320 WMIC.exe Token: SeRemoteShutdownPrivilege 2320 WMIC.exe Token: SeUndockPrivilege 2320 WMIC.exe Token: SeManageVolumePrivilege 2320 WMIC.exe Token: 33 2320 WMIC.exe Token: 34 2320 WMIC.exe Token: 35 2320 WMIC.exe Token: 36 2320 WMIC.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.execmd.exedescription pid process target process PID 400 wrote to memory of 4864 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe cmd.exe PID 400 wrote to memory of 4864 400 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe cmd.exe PID 4864 wrote to memory of 4856 4864 cmd.exe vssadmin.exe PID 4864 wrote to memory of 4856 4864 cmd.exe vssadmin.exe PID 4864 wrote to memory of 2320 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 2320 4864 cmd.exe WMIC.exe PID 4864 wrote to memory of 376 4864 cmd.exe bcdedit.exe PID 4864 wrote to memory of 376 4864 cmd.exe bcdedit.exe PID 4864 wrote to memory of 3148 4864 cmd.exe bcdedit.exe PID 4864 wrote to memory of 3148 4864 cmd.exe bcdedit.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe"C:\Users\Admin\AppData\Local\Temp\2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4856 -
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2320 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:376 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:3148
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3316
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1412 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:81⤵PID:1844
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4172
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵PID:1740
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{12A89450-697F-4958-B4EB-02191E0DEC28}.xps" 1335486308711000002⤵PID:2316
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exeOfficeC2RClient.exe /error PID=2316 ProcessName="Microsoft OneNote" UIType=3 ErrorSource=0x8b10082a ErrorCode=0x80004005 ShowUI=13⤵
- Process spawned unexpected child process
PID:2132
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD50070dbbbf4a3af6e34b2ab752cb3b459
SHA1b228e309bebb07b50d648b84f82a9a46fae7589b
SHA256b4da757c55d148c31f5082e923daf53376d100c025ab2266d7e62772dfba2cf4
SHA5123b8becf471935bf82599ffac2989b17eeb23cd7218853dc14ece669a4c12a9609833c9700966f9ca81d3824e74c8a750e2bbd1d894534f877a2f673eab7a4deb