Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-04-2024 13:35
Behavioral task
behavioral1
Sample
0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe
Resource
win10v2004-20240226-en
General
-
Target
0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe
-
Size
775KB
-
MD5
2d2a5a22bc983829cfb4627a271fbd4e
-
SHA1
c0fc01350ae774f3817d71710d9a6e9adaba441f
-
SHA256
0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b
-
SHA512
8237f6db84a2339827e4044929df58597733d04f8e56c621394f2c2b79c06dc9fb3e64373d0205c0f14372173875b2487d178472eda6837da2ef20187285ad0d
-
SSDEEP
24576:+Csq9+OXLpMePfI8TgmBTCDqEbOpPtpFaoxfq:YxOXLpMePfzVTCD7gPtLa4fq
Malware Config
Extracted
C:\Users\Admin\Contacts\ffGC5_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Extracted
C:\Users\Admin\Downloads\ffGC5_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Signatures
-
Avaddon
Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.
-
Avaddon payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Microsoft\Windows\0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe family_avaddon -
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
wmic.exewmic.exewmic.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2752 2620 wmic.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 492 2620 wmic.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2200 2620 wmic.exe -
Processes:
0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (209) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
Processes:
0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exepid process 1984 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe -
Processes:
0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exedescription ioc process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exedescription ioc process File opened (read-only) \??\H: 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe File opened (read-only) \??\I: 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe File opened (read-only) \??\R: 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe File opened (read-only) \??\T: 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe File opened (read-only) \??\W: 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe File opened (read-only) \??\G: 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe File opened (read-only) \??\J: 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe File opened (read-only) \??\K: 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe File opened (read-only) \??\L: 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe File opened (read-only) \??\N: 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe File opened (read-only) \??\Q: 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe File opened (read-only) \??\S: 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe File opened (read-only) \??\V: 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe File opened (read-only) \??\B: 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe File opened (read-only) \??\Z: 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe File opened (read-only) \??\F: 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe File opened (read-only) \??\Y: 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe File opened (read-only) \??\X: 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe File opened (read-only) \??\U: 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe File opened (read-only) \??\E: 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe File opened (read-only) \??\M: 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe File opened (read-only) \??\O: 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe File opened (read-only) \??\P: 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe File opened (read-only) \??\A: 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exevssadmin.exepid process 2144 vssadmin.exe 1272 vssadmin.exe 1264 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exepid process 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wmic.exewmic.exewmic.exedescription pid process Token: SeIncreaseQuotaPrivilege 2752 wmic.exe Token: SeSecurityPrivilege 2752 wmic.exe Token: SeTakeOwnershipPrivilege 2752 wmic.exe Token: SeLoadDriverPrivilege 2752 wmic.exe Token: SeSystemProfilePrivilege 2752 wmic.exe Token: SeSystemtimePrivilege 2752 wmic.exe Token: SeProfSingleProcessPrivilege 2752 wmic.exe Token: SeIncBasePriorityPrivilege 2752 wmic.exe Token: SeCreatePagefilePrivilege 2752 wmic.exe Token: SeBackupPrivilege 2752 wmic.exe Token: SeRestorePrivilege 2752 wmic.exe Token: SeShutdownPrivilege 2752 wmic.exe Token: SeDebugPrivilege 2752 wmic.exe Token: SeSystemEnvironmentPrivilege 2752 wmic.exe Token: SeRemoteShutdownPrivilege 2752 wmic.exe Token: SeUndockPrivilege 2752 wmic.exe Token: SeManageVolumePrivilege 2752 wmic.exe Token: 33 2752 wmic.exe Token: 34 2752 wmic.exe Token: 35 2752 wmic.exe Token: SeIncreaseQuotaPrivilege 492 wmic.exe Token: SeSecurityPrivilege 492 wmic.exe Token: SeTakeOwnershipPrivilege 492 wmic.exe Token: SeLoadDriverPrivilege 492 wmic.exe Token: SeSystemProfilePrivilege 492 wmic.exe Token: SeSystemtimePrivilege 492 wmic.exe Token: SeProfSingleProcessPrivilege 492 wmic.exe Token: SeIncBasePriorityPrivilege 492 wmic.exe Token: SeCreatePagefilePrivilege 492 wmic.exe Token: SeBackupPrivilege 492 wmic.exe Token: SeRestorePrivilege 492 wmic.exe Token: SeShutdownPrivilege 492 wmic.exe Token: SeDebugPrivilege 492 wmic.exe Token: SeSystemEnvironmentPrivilege 492 wmic.exe Token: SeRemoteShutdownPrivilege 492 wmic.exe Token: SeUndockPrivilege 492 wmic.exe Token: SeManageVolumePrivilege 492 wmic.exe Token: 33 492 wmic.exe Token: 34 492 wmic.exe Token: 35 492 wmic.exe Token: SeIncreaseQuotaPrivilege 2752 wmic.exe Token: SeSecurityPrivilege 2752 wmic.exe Token: SeTakeOwnershipPrivilege 2752 wmic.exe Token: SeLoadDriverPrivilege 2752 wmic.exe Token: SeSystemProfilePrivilege 2752 wmic.exe Token: SeSystemtimePrivilege 2752 wmic.exe Token: SeProfSingleProcessPrivilege 2752 wmic.exe Token: SeIncBasePriorityPrivilege 2752 wmic.exe Token: SeCreatePagefilePrivilege 2752 wmic.exe Token: SeBackupPrivilege 2752 wmic.exe Token: SeRestorePrivilege 2752 wmic.exe Token: SeShutdownPrivilege 2752 wmic.exe Token: SeDebugPrivilege 2752 wmic.exe Token: SeSystemEnvironmentPrivilege 2752 wmic.exe Token: SeRemoteShutdownPrivilege 2752 wmic.exe Token: SeUndockPrivilege 2752 wmic.exe Token: SeManageVolumePrivilege 2752 wmic.exe Token: 33 2752 wmic.exe Token: 34 2752 wmic.exe Token: 35 2752 wmic.exe Token: SeIncreaseQuotaPrivilege 2200 wmic.exe Token: SeSecurityPrivilege 2200 wmic.exe Token: SeTakeOwnershipPrivilege 2200 wmic.exe Token: SeLoadDriverPrivilege 2200 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exetaskeng.exedescription pid process target process PID 2020 wrote to memory of 2404 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe wmic.exe PID 2020 wrote to memory of 2404 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe wmic.exe PID 2020 wrote to memory of 2404 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe wmic.exe PID 2020 wrote to memory of 2404 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe wmic.exe PID 2020 wrote to memory of 2144 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe vssadmin.exe PID 2020 wrote to memory of 2144 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe vssadmin.exe PID 2020 wrote to memory of 2144 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe vssadmin.exe PID 2020 wrote to memory of 2144 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe vssadmin.exe PID 2020 wrote to memory of 1876 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe wmic.exe PID 2020 wrote to memory of 1876 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe wmic.exe PID 2020 wrote to memory of 1876 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe wmic.exe PID 2020 wrote to memory of 1876 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe wmic.exe PID 2020 wrote to memory of 1272 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe vssadmin.exe PID 2020 wrote to memory of 1272 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe vssadmin.exe PID 2020 wrote to memory of 1272 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe vssadmin.exe PID 2020 wrote to memory of 1272 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe vssadmin.exe PID 2020 wrote to memory of 2208 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe wmic.exe PID 2020 wrote to memory of 2208 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe wmic.exe PID 2020 wrote to memory of 2208 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe wmic.exe PID 2020 wrote to memory of 2208 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe wmic.exe PID 2020 wrote to memory of 1264 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe vssadmin.exe PID 2020 wrote to memory of 1264 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe vssadmin.exe PID 2020 wrote to memory of 1264 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe vssadmin.exe PID 2020 wrote to memory of 1264 2020 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe vssadmin.exe PID 2156 wrote to memory of 1984 2156 taskeng.exe 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe PID 2156 wrote to memory of 1984 2156 taskeng.exe 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe PID 2156 wrote to memory of 1984 2156 taskeng.exe 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe PID 2156 wrote to memory of 1984 2156 taskeng.exe 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe"C:\Users\Admin\AppData\Local\Temp\0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic SHADOWCOPY DELETE /nointeractive2⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic SHADOWCOPY DELETE /nointeractive2⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic SHADOWCOPY DELETE /nointeractive2⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
C:\Windows\system32\wbem\wmic.exewmic SHADOWCOPY DELETE /nointeractive1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\wmic.exewmic SHADOWCOPY DELETE /nointeractive1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\wmic.exewmic SHADOWCOPY DELETE /nointeractive1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {1284A766-11F3-484A-9CD5-300F6C5863D2} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Indicator Removal
2File Deletion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\0ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b.exeFilesize
775KB
MD52d2a5a22bc983829cfb4627a271fbd4e
SHA1c0fc01350ae774f3817d71710d9a6e9adaba441f
SHA2560ff4058f709d278ed662719b9627618c48e7a656c59f6bfecda9081c7cbd742b
SHA5128237f6db84a2339827e4044929df58597733d04f8e56c621394f2c2b79c06dc9fb3e64373d0205c0f14372173875b2487d178472eda6837da2ef20187285ad0d
-
C:\Users\Admin\Contacts\ffGC5_readme_.txtFilesize
3KB
MD54dad5dc44e951b91b8a337ce37081c37
SHA10fdfc1b426e46d6178959b6a8e348ca80efdea4a
SHA2566d7c710cd0259ec45363b1bcd0114b183341a2e9b932da3e11ab43584cb3f5db
SHA51238853dca68b1d27011f453fd339d5d9e5d9761b01c72837afe4c80ab1c1ee1f3d22f5db07c5859ae1e7b4edd85383baae18bfd76400a90fef6a8e6af05fa9029
-
C:\Users\Admin\Downloads\ffGC5_readme_.txtFilesize
3KB
MD54023c30b507eb2bf1e74f35b2f99be68
SHA1e477645534109ee897a0301d5eea50b13ea62dbf
SHA25636b93ba580c7590cb964d232bfd97b770fac150ec58a98dfa0dad08141503b5f
SHA512680ee1b342e30225eb2ff9e432326f6c29b4d3e4c19242c100a4dcc493a781336fa2d9f3b050f185608c54115cc86ef224b405a5d336c85cada983a8f5f2bef0