Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-04-2024 13:35
Behavioral task
behavioral1
Sample
48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe
-
Size
775KB
-
MD5
117da2dd6fa24616f63eb43d5a15e5d3
-
SHA1
b4d70eecdef52ceef15f04a025d1ab08f193fb97
-
SHA256
48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275
-
SHA512
de2e5538e8dd8210b630eca0fc611f0ba0dcb805b3a745c38a6f46ee9acfe8785c917b9452e0d6f70f675030430b65b352d695106bae639b20e0dbb2dd95e375
-
SSDEEP
24576:TCsQ9+OXLpMePfI8TgmBTCDqEbOpPtpFhAxfq:5HOXLpMePfzVTCD7gPtLhQfq
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\DtJlOhFS_readme_.txt
Family
avaddon
Ransom Note
-------=== Your network has been infected! ===-------
***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED *****************
All your documents, photos, databases and other important files have been encrypted and have the extension: .ecCeCbbcD
You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files!
The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files!
We have also downloaded a lot of private data from your network.
If you do not contact as in a 3 days we will post information about your breach on our public news website (avaddongun7rngel.onion) and after 7 days the whole downloaded info.
You can get more information on our page, which is located in a Tor hidden network.
How to get to our page
--------------------------------------------------------------------------------
|
| 1. Download Tor browser - https://www.torproject.org/
|
| 2. Install Tor browser
|
| 3. Open link in Tor browser - avaddonbotrxmuyl.onion
|
| 4. Follow the instructions on this page
|
--------------------------------------------------------------------------------
Your ID:
--------------------------------------------------------------------------------
MjcwMS1iVk1iVjZObGRRYXdCNHNqc0NSODNpd2owT1lhK3czMHpoemZJaERKNHZnSUQ4VDhQTFlsL3lLNG1mVVhFTUdNU3hPSGppYlZ5cCsweUJNMzZ4b0lTQU5ERk9hSGVuYWZzYVd1UHdtZFFESldKeHNOd1VML05meE1rSEs2NEFyWkEweWRiRTJlWWxtOW1va1k4cWRUaUhDQ0xTaWZHSVNTRTl2bzhrblhrdExJdHVDOWFWZzJ2TURhMXZFODgrMmVPVkhlbXlhQmxLT01WdWdrQTM0anZld2pPeDlicGxPbExyenhabllDWEhWQSs4MDB6UVd5R1RBM0VUYlNhcktBdXEycWdKVnV3TGJwVDhTKzRwbHhkSHBnTHFyZ3l1a2E3NlZWc0hobkRMZ2ZhZTc0QTRtUGxKYUR4bXlUb0txVi8xUGFHTWUwcU0yRHkyR0g5aU8xcUkrb1VUYWM3Sk8rMUdYbVVmVWpLM0hWekUvVUR5NjBONzRxcDZmdHp2RXJrMXBvSmplVDMyR0l3MUxqdStpb2pvUkY3S0U0NFhMSnptTVBVVXZMUERwSnJwUERSTzh2MFVGalVERWxDb1JKTG95TVpZVjkxYTVpcmw0YWxRYkVVSGowbVlkQVFhNXZvck50alpRVE84R25tSkVLKzFVaVltcjErNkhEV01ybDR0V3A4ZUtIdlFRNXllYkUrVXFpMkJwTXgyTzhLVXRTSXRxS1BzRXdSR1ZXYXl5ZFBRK1BNMURRNGpzbThjaUZHRVNuMzhubVJPTERMaTRjaUlhTk0vS1JIUmpuN0dVZUpHTW1raUFBQ2lSclIyUVV2VGM0Y0s2QTZ6ZXJQMmlyUlIzZlZ6Y2dXOVpsb2ZmNGxCbTJNLzRyK0RjNmNIS3lPeGFIYmVsV3dGRjFMczZiSHBWR29tbkJ5Mjg2QW5jVERCRHJlWmJzb0xXaUR0VkpvNUdBNzE2TUFob0VsVE5MVnZDNDlvdnlwdkJZTTZ1cHowUkNqbGp4ZlIwdzl4Q2VWYkN0NmowZUc4dzU2aGtlaExHL1hNVlJocXJHaUNEaGtjVG1WMm01OVlueVMwVXRERG5pK1NVQzNmMmxuaEZWTXplelVrRW0yOWIxTVNIcjNIcVRWQW0yMGJ6K2d4QU9ZMHBybzRmN2phd005MVdjK2NJbjJzSWYwWnJPZzNpTEIyUjFMM0sybXUrZ1N3Q01HNXZHMFo4NU5TTTh2RHgxcGR3ZENXL1NkRVdrRDZ0OFdvaHFyRDFTRnBFdnNVMXNGeVZmYVQ4OEFvZHNSS0ErU2xQcE9PWTFSY09pWVEwcFhzV2tmeisxUFhVa3BaZk50d2Jrck1EOG13ekp5ZDl2dmg3cTMvMU9pMEV4N1FDS25LeXZKbWVPNCsxVmg0NW1sdVZUY3BHeGVVSFQybDJVbWV3bTVqREJqOWgzNlM1aTJQVlRmK3Z2WmtUZjFXK0hZdTVJMUpxeGpOMk1RS09nUUtuby9Zd2xrT2ROdm1FNFl4eE5lTElJanR4RkRzTTNwYU5UMmVSb1NlNTZxWjZweDQ5SHBMSGdWdWhyMXJHYU1UenlUQkhSWG5ZY3VaWEMrckcrU3pFdnNiM3pEaWg3TmErczZZdEhYWWlrcnZ2RnkwWUl1VEptakRpZE4wQVM3U1BJWWlKaXAvcjlxTDNVbk1xRW50TTIzUGJjU0tMOHEzczNNQnRlOXR1bFFiZmJKbWVpdktCa1FiZElwZHNCTFI1T3gybll6azdyallZYXEwUDlwVStURGY5K2g0Z1hPSGZFZkJrUmdiUFRPNVBCVEU2cklpUllWdkkxRTIrMVFQcDJGbUo4eGpWZmVJTzZZT2JncUdmM3phOEpRODNsQ1IxekF0MVJ6YVpWekl6cGRyYk1XV3dhTlZ3dm9nMVlUVGx5dUNXZkhvdUIzUWxQdlNGbVlDOERzV0c1SzFlOXQ0bnlaUk1meFJmU3ZFZzBaUmZyRWhVT3lqWk0rekxvUU4wZThpb1NnTFA3VkNiTFMvQk1mQ1cvdXFibXlOSE9xUnd5NDhlRkRobE5wK2JMbkRWc01vN1lYamhJN3E4QWRJZ2F3alA3c240RHN2YlVlU294MnpxM3k1NHBJOEtIcGxUcmpjZUNsR0RycGZ1RkpLNDMwUT09
--------------------------------------------------------------------------------
* DO NOT TRY TO RECOVER FILES YOURSELF!
* DO NOT MODIFY ENCRYPTED FILES!
* * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * *
wd1V46KZGZQUw0pzZJ7uIftteYU0vE
URLs
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Signatures
-
Avaddon
Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.
-
Avaddon payload 1 IoCs
resource yara_rule behavioral2/files/0x0008000000023201-357.dat family_avaddon -
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4888 4320 wmic.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1228 4320 wmic.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1368 4320 wmic.exe 85 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (123) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
pid Process 2800 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-983155329-280873152-1838004294-1000\desktop.ini 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe File opened (read-only) \??\W: 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe File opened (read-only) \??\N: 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe File opened (read-only) \??\O: 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe File opened (read-only) \??\P: 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe File opened (read-only) \??\R: 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe File opened (read-only) \??\T: 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe File opened (read-only) \??\X: 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe File opened (read-only) \??\A: 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe File opened (read-only) \??\G: 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe File opened (read-only) \??\I: 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe File opened (read-only) \??\S: 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe File opened (read-only) \??\U: 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe File opened (read-only) \??\Y: 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe File opened (read-only) \??\Z: 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe File opened (read-only) \??\F: 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe File opened (read-only) \??\B: 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe File opened (read-only) \??\J: 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe File opened (read-only) \??\L: 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe File opened (read-only) \??\Q: 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe File opened (read-only) \??\E: 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe File opened (read-only) \??\H: 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe File opened (read-only) \??\K: 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe File opened (read-only) \??\M: 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4888 wmic.exe Token: SeSecurityPrivilege 4888 wmic.exe Token: SeTakeOwnershipPrivilege 4888 wmic.exe Token: SeLoadDriverPrivilege 4888 wmic.exe Token: SeSystemProfilePrivilege 4888 wmic.exe Token: SeSystemtimePrivilege 4888 wmic.exe Token: SeProfSingleProcessPrivilege 4888 wmic.exe Token: SeIncBasePriorityPrivilege 4888 wmic.exe Token: SeCreatePagefilePrivilege 4888 wmic.exe Token: SeBackupPrivilege 4888 wmic.exe Token: SeRestorePrivilege 4888 wmic.exe Token: SeShutdownPrivilege 4888 wmic.exe Token: SeDebugPrivilege 4888 wmic.exe Token: SeSystemEnvironmentPrivilege 4888 wmic.exe Token: SeRemoteShutdownPrivilege 4888 wmic.exe Token: SeUndockPrivilege 4888 wmic.exe Token: SeManageVolumePrivilege 4888 wmic.exe Token: 33 4888 wmic.exe Token: 34 4888 wmic.exe Token: 35 4888 wmic.exe Token: 36 4888 wmic.exe Token: SeIncreaseQuotaPrivilege 664 wmic.exe Token: SeSecurityPrivilege 664 wmic.exe Token: SeTakeOwnershipPrivilege 664 wmic.exe Token: SeLoadDriverPrivilege 664 wmic.exe Token: SeSystemProfilePrivilege 664 wmic.exe Token: SeSystemtimePrivilege 664 wmic.exe Token: SeProfSingleProcessPrivilege 664 wmic.exe Token: SeIncBasePriorityPrivilege 664 wmic.exe Token: SeCreatePagefilePrivilege 664 wmic.exe Token: SeBackupPrivilege 664 wmic.exe Token: SeRestorePrivilege 664 wmic.exe Token: SeShutdownPrivilege 664 wmic.exe Token: SeDebugPrivilege 664 wmic.exe Token: SeSystemEnvironmentPrivilege 664 wmic.exe Token: SeRemoteShutdownPrivilege 664 wmic.exe Token: SeUndockPrivilege 664 wmic.exe Token: SeManageVolumePrivilege 664 wmic.exe Token: 33 664 wmic.exe Token: 34 664 wmic.exe Token: 35 664 wmic.exe Token: 36 664 wmic.exe Token: SeIncreaseQuotaPrivilege 1228 wmic.exe Token: SeSecurityPrivilege 1228 wmic.exe Token: SeTakeOwnershipPrivilege 1228 wmic.exe Token: SeLoadDriverPrivilege 1228 wmic.exe Token: SeSystemProfilePrivilege 1228 wmic.exe Token: SeSystemtimePrivilege 1228 wmic.exe Token: SeProfSingleProcessPrivilege 1228 wmic.exe Token: SeIncBasePriorityPrivilege 1228 wmic.exe Token: SeCreatePagefilePrivilege 1228 wmic.exe Token: SeBackupPrivilege 1228 wmic.exe Token: SeRestorePrivilege 1228 wmic.exe Token: SeShutdownPrivilege 1228 wmic.exe Token: SeDebugPrivilege 1228 wmic.exe Token: SeSystemEnvironmentPrivilege 1228 wmic.exe Token: SeRemoteShutdownPrivilege 1228 wmic.exe Token: SeUndockPrivilege 1228 wmic.exe Token: SeManageVolumePrivilege 1228 wmic.exe Token: 33 1228 wmic.exe Token: 34 1228 wmic.exe Token: 35 1228 wmic.exe Token: 36 1228 wmic.exe Token: SeIncreaseQuotaPrivilege 1368 wmic.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1376 wrote to memory of 664 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 91 PID 1376 wrote to memory of 664 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 91 PID 1376 wrote to memory of 664 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 91 PID 1376 wrote to memory of 1284 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 97 PID 1376 wrote to memory of 1284 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 97 PID 1376 wrote to memory of 1284 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 97 PID 1376 wrote to memory of 2308 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 99 PID 1376 wrote to memory of 2308 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 99 PID 1376 wrote to memory of 2308 1376 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe 99 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe"C:\Users\Admin\AppData\Local\Temp\48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1376 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic SHADOWCOPY DELETE /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:664
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic SHADOWCOPY DELETE /nointeractive2⤵PID:1284
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic SHADOWCOPY DELETE /nointeractive2⤵PID:2308
-
-
C:\Windows\system32\wbem\wmic.exewmic SHADOWCOPY DELETE /nointeractive1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:4888
-
C:\Windows\system32\wbem\wmic.exewmic SHADOWCOPY DELETE /nointeractive1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:1228
-
C:\Windows\system32\wbem\wmic.exewmic SHADOWCOPY DELETE /nointeractive1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:1368
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:4632
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe1⤵
- Executes dropped EXE
PID:2800
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1File Deletion
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\48d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275.exe
Filesize775KB
MD5117da2dd6fa24616f63eb43d5a15e5d3
SHA1b4d70eecdef52ceef15f04a025d1ab08f193fb97
SHA25648d7cd572f14aed7a90d6b66097a885a889e6e7416a6aaa2eb442706ff661275
SHA512de2e5538e8dd8210b630eca0fc611f0ba0dcb805b3a745c38a6f46ee9acfe8785c917b9452e0d6f70f675030430b65b352d695106bae639b20e0dbb2dd95e375
-
Filesize
3KB
MD517635ee2d1ce781235b3065913cffd14
SHA10651f70d0667e85b11590355ad2c8a106fe74eaa
SHA25690466c6e5e1a89db484147d644788f0bd8cfb5292ea9d2c571159040188872f3
SHA512ccd18ef1a00aab03cf37cd0b36fc856e37690d5afba838556759ca07f5047df8bcafb279c5ac24f1577ccfc43d749969757c5d8a7b8d7ce6d977bd499eb0dc6d