Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
14-03-2024 04:21
Static task
static1
Behavioral task
behavioral1
Sample
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe
Resource
win10v2004-20240226-en
General
-
Target
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe
-
Size
959KB
-
MD5
df7a9a45a10c1942225eb9be257fb752
-
SHA1
874630d6f4bdf9224125d35f30c48bc6d1da8ec1
-
SHA256
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f
-
SHA512
c812b5bfbba51b196954e0c14668e3b46b79db3c62848a8be4f96ef12105948e22e41949c5a62e661ddda0126900d5058cf641b3351fa4b0ce0a3e7fd2aecbe2
-
SSDEEP
24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdsF:Ujrc2So1Ff+B3k796e
Malware Config
Extracted
C:\Program Files\Java\jdk1.7.0_80\db\Restore-My-Files.txt
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
https://bigblog.at
http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
https://decoding.at
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 1740 bcdedit.exe 2324 bcdedit.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\{E7894974-2828-CFE0-79A7-7920B9D0E148} = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe\"" c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exedescription ioc process File opened (read-only) \??\F: c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe -
Drops file in System32 directory 1 IoCs
Processes:
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exedescription ioc process File created C:\windows\SysWOW64\F189D8.ico c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 21 IoCs
Processes:
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exepid process 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe -
Drops file in Program Files directory 64 IoCs
Processes:
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exedescription ioc process File opened for modification C:\program files (x86)\microsoft office\media\cagcat10\j0299171.wmf c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsstyles\country.css c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\currency.gadget\it-it\gadget.xml c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_ja_4.4.0.v20140623020002.jar c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\java\jre7\lib\management\jmxremote.access c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\hh00260_.wmf c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\pe02288_.wmf c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\wb01840_.gif c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\microsoft office\office14\pubwiz\prog98.poc c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_ja_4.4.0.v20140623020002.jar c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\profiler\config\modules\org-netbeans-modules-profiler-heapwalker.xml c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\adobe\reader 9.0\reader\tracker\turnoffnotificationinacrobat.gif c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\so02437_.wmf c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\microsoft office\document themes 14\solstice.thmx c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\zi\asia\yakutsk c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\windows sidebar\gadgets\picturepuzzle.gadget\es-es\css\settings.css c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\bg_formshomepage.gif c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.contexts_1.3.100.v20140407-1019.jar c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\bl00122_.wmf c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\windows sidebar\gadgets\weather.gadget\images\undocked_black_moon-full_partly-cloudy.png c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\microsoft office\office14\pubwiz\letthead.xml c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\management\jmxremote.access c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\bl00130_.wmf c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_preferencestyle.css c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-uihandler.xml c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File created C:\program files\videolan\vlc\locale\gu\lc_messages\Restore-My-Files.txt c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0099157.jpg c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0281243.wmf c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\microsoft office\office14\1033\msaccess.dev_col.hxc c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\performance\title_trans_notes.wmv c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\security\java.policy c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\weather.gadget\it-it\settings.html c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\rssfeeds.gadget\images\rssbackblue_docked.png c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\weather.gadget\images\undocked_black_hail.png c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\windows sidebar\gadgets\weather.gadget\en-us\settings.html c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\graycheck\tab_off.gif c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsviewattachmenticonsmask.bmp c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_ja_4.4.0.v20140623020002.jar c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\videolan\vlc\locale\sq\lc_messages\vlc.mo c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\toolbmps\logindialogbackground.jpg c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\zi\america\montreal c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\microsoft office\media\cagcat10\j0300912.wmf c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File created C:\program files (x86)\adobe\reader 9.0\reader\plug_ins\annotations\stamps\Restore-My-Files.txt c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\microsoft office\media\cagcat10\j0302953.jpg c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\formsformtemplate.html c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\zi\systemv\mst7mdt c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_zh_cn.jar c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\java\jre7\lib\zi\america\kentucky\monticello c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\java\jre7\lib\zi\america\swift_current c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\java\jre7\lib\zi\antarctica\rothera c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\java\jre7\lib\zi\pacific\auckland c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File created C:\program files\microsoft games\more games\ja-jp\Restore-My-Files.txt c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\windows sidebar\gadgets\weather.gadget\images\120dpi\(120dpi)redstateicon.png c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\babygirl\bear_formatted_rgb6_pal.wmv c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\visualvm\.lastmodified c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\microsoft office\office14\pubwiz\postcd98.poc c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\microsoft office\office14\pubwiz\quikpubs.poc c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\adobe\reader 9.0\resource\enutxt.pdf c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\rtf_alignleft.gif c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File created C:\program files (x86)\microsoft office\office14\groove\xml files\Restore-My-Files.txt c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\so00466_.wmf c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms\formsblankpage.html c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files (x86)\microsoft office\office14\pubwiz\dgbarbll.dpv c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\meta-inf\eclipse.inf c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1192 vssadmin.exe -
Modifies registry class 3 IoCs
Processes:
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exedescription ioc process Key created \Registry\Machine\Software\Classes\.lockbit c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe Key created \Registry\Machine\Software\Classes\.lockbit\DefaultIcon c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lockbit\DefaultIcon\ = "C:\\windows\\SysWow64\\F189D8.ico" c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
Processes:
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exepid process 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exevssvc.exeWMIC.exedescription pid process Token: SeTakeOwnershipPrivilege 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe Token: SeDebugPrivilege 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe Token: SeBackupPrivilege 1256 vssvc.exe Token: SeRestorePrivilege 1256 vssvc.exe Token: SeAuditPrivilege 1256 vssvc.exe Token: SeIncreaseQuotaPrivilege 1336 WMIC.exe Token: SeSecurityPrivilege 1336 WMIC.exe Token: SeTakeOwnershipPrivilege 1336 WMIC.exe Token: SeLoadDriverPrivilege 1336 WMIC.exe Token: SeSystemProfilePrivilege 1336 WMIC.exe Token: SeSystemtimePrivilege 1336 WMIC.exe Token: SeProfSingleProcessPrivilege 1336 WMIC.exe Token: SeIncBasePriorityPrivilege 1336 WMIC.exe Token: SeCreatePagefilePrivilege 1336 WMIC.exe Token: SeBackupPrivilege 1336 WMIC.exe Token: SeRestorePrivilege 1336 WMIC.exe Token: SeShutdownPrivilege 1336 WMIC.exe Token: SeDebugPrivilege 1336 WMIC.exe Token: SeSystemEnvironmentPrivilege 1336 WMIC.exe Token: SeRemoteShutdownPrivilege 1336 WMIC.exe Token: SeUndockPrivilege 1336 WMIC.exe Token: SeManageVolumePrivilege 1336 WMIC.exe Token: 33 1336 WMIC.exe Token: 34 1336 WMIC.exe Token: 35 1336 WMIC.exe Token: SeIncreaseQuotaPrivilege 1336 WMIC.exe Token: SeSecurityPrivilege 1336 WMIC.exe Token: SeTakeOwnershipPrivilege 1336 WMIC.exe Token: SeLoadDriverPrivilege 1336 WMIC.exe Token: SeSystemProfilePrivilege 1336 WMIC.exe Token: SeSystemtimePrivilege 1336 WMIC.exe Token: SeProfSingleProcessPrivilege 1336 WMIC.exe Token: SeIncBasePriorityPrivilege 1336 WMIC.exe Token: SeCreatePagefilePrivilege 1336 WMIC.exe Token: SeBackupPrivilege 1336 WMIC.exe Token: SeRestorePrivilege 1336 WMIC.exe Token: SeShutdownPrivilege 1336 WMIC.exe Token: SeDebugPrivilege 1336 WMIC.exe Token: SeSystemEnvironmentPrivilege 1336 WMIC.exe Token: SeRemoteShutdownPrivilege 1336 WMIC.exe Token: SeUndockPrivilege 1336 WMIC.exe Token: SeManageVolumePrivilege 1336 WMIC.exe Token: 33 1336 WMIC.exe Token: 34 1336 WMIC.exe Token: 35 1336 WMIC.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.execmd.exedescription pid process target process PID 1952 wrote to memory of 1892 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe cmd.exe PID 1952 wrote to memory of 1892 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe cmd.exe PID 1952 wrote to memory of 1892 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe cmd.exe PID 1952 wrote to memory of 1892 1952 c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe cmd.exe PID 1892 wrote to memory of 1192 1892 cmd.exe vssadmin.exe PID 1892 wrote to memory of 1192 1892 cmd.exe vssadmin.exe PID 1892 wrote to memory of 1192 1892 cmd.exe vssadmin.exe PID 1892 wrote to memory of 1336 1892 cmd.exe WMIC.exe PID 1892 wrote to memory of 1336 1892 cmd.exe WMIC.exe PID 1892 wrote to memory of 1336 1892 cmd.exe WMIC.exe PID 1892 wrote to memory of 1740 1892 cmd.exe bcdedit.exe PID 1892 wrote to memory of 1740 1892 cmd.exe bcdedit.exe PID 1892 wrote to memory of 1740 1892 cmd.exe bcdedit.exe PID 1892 wrote to memory of 2324 1892 cmd.exe bcdedit.exe PID 1892 wrote to memory of 2324 1892 cmd.exe bcdedit.exe PID 1892 wrote to memory of 2324 1892 cmd.exe bcdedit.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe"C:\Users\Admin\AppData\Local\Temp\c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1192 -
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1336 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:1740 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2324
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1256
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD590430b01710fa3927be7b9b3ff886af9
SHA14b93beb1b3a4f6dbd6463e1847a2ca98fa03292f
SHA256aaf4c726ebc7cfbbf541ce126b71e8c25688b0ac2fbdd5ea72f5837572aaa073
SHA512e43637930326fa169827dbdc69c1b36a5e402a943d3adb0e0dafaacef4260d1c8f41db2c9ac54f39ba18e3e3658d5b610cd623e4e598a2225e0d03ca3442914d