Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26/03/2024, 11:46
Static task
static1
Behavioral task
behavioral1
Sample
19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe
Resource
win10v2004-20240226-en
General
-
Target
19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe
-
Size
148KB
-
MD5
64fc181e2dead2367f1c04ab9261e84d
-
SHA1
acea0a849bb13ea7254639612dc73271f90caddb
-
SHA256
19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708
-
SHA512
d43feb42582460e4fd9af0231e746ea2d05d579d2b2669550240b740e57b05f3fb3f3c751f940c0483d09c8960dd3c087ac075b5ab75b109c7e674ac0f44db8d
-
SSDEEP
3072:ym0ROZIL87L1yoklfzGp3XjRaDRMqqD/A6lHlC:ypMCL8rpHjRaOqqD/RjC
Malware Config
Extracted
C:\Program Files\dotnet\Restore-My-Files.txt
lockbit
http://lockbit-decryptor.com/?BD61F8CA9173670ACAD600354B179BB5
http://lockbitks2tvnmwk.onion/?BD61F8CA9173670ACAD600354B179BB5
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 548 bcdedit.exe 2956 bcdedit.exe -
Renames multiple (14230) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 5032 wbadmin.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XO1XADpO01 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe\"" 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.png.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\ui-strings.js.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.WindowsDesktop.App.runtimeconfig.json.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Certificates_R.aapp.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-es_es.gif.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentlogon.xml.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ClassicPhotoAlbum.potx.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\tr-tr\Restore-My-Files.txt 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\uk-ua\Restore-My-Files.txt 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\Java\jdk-1.8\jvisualvm.txt.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Retrospect.thmx.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-140.png.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\example_icons2x.png.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-phn.xrm-ms.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-pl.xrm-ms.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\PSReadLine.format.ps1xml.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\S_IlluDCFilesEmpty_180x180.svg.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nl-nl\ui-strings.js.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\Restore-My-Files.txt 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\Restore-My-Files.txt 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-100.png.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-100.png.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\themes\dark\Restore-My-Files.txt 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\cs-cz\ui-strings.js.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files (x86)\Windows Media Player\ja-JP\wmpnssci.dll.mui.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sortedby_selected_18.svg.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-tw\ui-strings.js.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\icons.png.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-ae\ui-strings.js.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\TURABIAN.XSL.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ppd.xrm-ms.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\eu-es\ui-strings.js.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-il\ui-strings.js.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_unshare_18.svg.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\ui-strings.js.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\LICENSE.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\new_icons_retina.png.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\illustrations_retina.png.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\Restore-My-Files.txt 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sk-sk\ui-strings.js.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ca-es\ui-strings.js.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ul-oob.xrm-ms.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MML2OMML.XSL.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\Restore-My-Files.txt 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_nothumbnail_34.svg.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-pl.xrm-ms.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files\Mozilla Firefox\fonts\TwemojiMozilla.ttf.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\ui-strings.js.lockbit 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3576 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe Token: SeDebugPrivilege 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe Token: SeBackupPrivilege 2036 vssvc.exe Token: SeRestorePrivilege 2036 vssvc.exe Token: SeAuditPrivilege 2036 vssvc.exe Token: SeIncreaseQuotaPrivilege 4424 WMIC.exe Token: SeSecurityPrivilege 4424 WMIC.exe Token: SeTakeOwnershipPrivilege 4424 WMIC.exe Token: SeLoadDriverPrivilege 4424 WMIC.exe Token: SeSystemProfilePrivilege 4424 WMIC.exe Token: SeSystemtimePrivilege 4424 WMIC.exe Token: SeProfSingleProcessPrivilege 4424 WMIC.exe Token: SeIncBasePriorityPrivilege 4424 WMIC.exe Token: SeCreatePagefilePrivilege 4424 WMIC.exe Token: SeBackupPrivilege 4424 WMIC.exe Token: SeRestorePrivilege 4424 WMIC.exe Token: SeShutdownPrivilege 4424 WMIC.exe Token: SeDebugPrivilege 4424 WMIC.exe Token: SeSystemEnvironmentPrivilege 4424 WMIC.exe Token: SeRemoteShutdownPrivilege 4424 WMIC.exe Token: SeUndockPrivilege 4424 WMIC.exe Token: SeManageVolumePrivilege 4424 WMIC.exe Token: 33 4424 WMIC.exe Token: 34 4424 WMIC.exe Token: 35 4424 WMIC.exe Token: 36 4424 WMIC.exe Token: SeIncreaseQuotaPrivilege 4424 WMIC.exe Token: SeSecurityPrivilege 4424 WMIC.exe Token: SeTakeOwnershipPrivilege 4424 WMIC.exe Token: SeLoadDriverPrivilege 4424 WMIC.exe Token: SeSystemProfilePrivilege 4424 WMIC.exe Token: SeSystemtimePrivilege 4424 WMIC.exe Token: SeProfSingleProcessPrivilege 4424 WMIC.exe Token: SeIncBasePriorityPrivilege 4424 WMIC.exe Token: SeCreatePagefilePrivilege 4424 WMIC.exe Token: SeBackupPrivilege 4424 WMIC.exe Token: SeRestorePrivilege 4424 WMIC.exe Token: SeShutdownPrivilege 4424 WMIC.exe Token: SeDebugPrivilege 4424 WMIC.exe Token: SeSystemEnvironmentPrivilege 4424 WMIC.exe Token: SeRemoteShutdownPrivilege 4424 WMIC.exe Token: SeUndockPrivilege 4424 WMIC.exe Token: SeManageVolumePrivilege 4424 WMIC.exe Token: 33 4424 WMIC.exe Token: 34 4424 WMIC.exe Token: 35 4424 WMIC.exe Token: 36 4424 WMIC.exe Token: SeBackupPrivilege 808 wbengine.exe Token: SeRestorePrivilege 808 wbengine.exe Token: SeSecurityPrivilege 808 wbengine.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3668 wrote to memory of 1312 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 90 PID 3668 wrote to memory of 1312 3668 19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe 90 PID 1312 wrote to memory of 3576 1312 cmd.exe 92 PID 1312 wrote to memory of 3576 1312 cmd.exe 92 PID 1312 wrote to memory of 4424 1312 cmd.exe 96 PID 1312 wrote to memory of 4424 1312 cmd.exe 96 PID 1312 wrote to memory of 548 1312 cmd.exe 98 PID 1312 wrote to memory of 548 1312 cmd.exe 98 PID 1312 wrote to memory of 2956 1312 cmd.exe 99 PID 1312 wrote to memory of 2956 1312 cmd.exe 99 PID 1312 wrote to memory of 5032 1312 cmd.exe 100 PID 1312 wrote to memory of 5032 1312 cmd.exe 100 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe"C:\Users\Admin\AppData\Local\Temp\19ca5aa4cd62929afb255d2b38e70fd3143e3b181889e84348a5c896e577d708.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet2⤵
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3576
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4424
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:548
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2956
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:5032
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2036
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:808
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:4384
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:1644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5001826c60dd5f976f9c3203f94465b3b
SHA1889898c9c35c7fcc5e1ca5255d1470dd2c89d899
SHA2565e9c369fd411f00ed479554987cc82eb6c9a70b9ee6ac373927dc201994e1d8d
SHA512c140e8033adc950fd60b8a75d882e9332c0ed61d6fc8f37eed3f23b2726ae957af639765bdd3b9d4a62eb8cd32b3e012dd4c020262aa0631f2177420c9bd8117