Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17/04/2024, 13:37
Behavioral task
behavioral1
Sample
cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe
Resource
win7-20240221-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe
-
Size
719KB
-
MD5
275e4a63fc63c995b3e0d464919f211b
-
SHA1
51d85210c2f621ca14d92a8375ee24d62f9d7f44
-
SHA256
cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46
-
SHA512
1723fb4a624859cb49f1d00100a44c5104a8a6ee4685b0e0988fa54f929dc7d70d171034577a17db2e6529d6c19b49d2ba023c4c98e9637f92981a3c1a5c9dac
-
SSDEEP
12288:OR8hjUV679Aa4Auw3gveB17cOT1WHWEQTe0udkuHgCNU7SY/qgjjmJ/:quK679Aa4Auw3gveB1TGWEQSzXY/tjq/
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\GxDf8_readme_.txt
Family
avaddon
Ransom Note
-------=== Your network has been infected! ===-------
***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED *****************
All your documents, photos, databases and other important files have been encrypted and have the extension: .BAeeDbEBdC
You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files!
The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files!
We have also downloaded a lot of private data from your network.
If you do not contact as in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info.
You can get more information on our page, which is located in a Tor hidden network.
How to get to our page
--------------------------------------------------------------------------------
|
| 1. Download Tor browser - https://www.torproject.org/
|
| 2. Install Tor browser
|
| 3. Open link in Tor browser - avaddonbotrxmuyl.onion
|
| 4. Follow the instructions on this page
|
--------------------------------------------------------------------------------
Your ID:
--------------------------------------------------------------------------------
NTc2LUYwZ0tkMHVGaTdLRkFxbXdqTkxocE9FbHk1QkhrRlcwNTdQQnEzbTQvMGFQWTlaOEtiRUZzUnptejc2SlN3TzRGZVhmM2dvN1EvcnJvSEVKL2FIejVQcTFYRm1HU2xXSVFPcFVlUmlvRjQ1U29EZlYwc3R1bklKYy83dDlpckMwS2lmb24zUG1MeW42c0VCQ3dYNzVPVE1wQjlTWUI4dU5paHZkVnUzTHdqemdnUU9jU0pQaG1rV1lqQVcwQTd0Z21jcTBuZ0JYQjZ2VTlpb0g5WHZlTU5TcnVFYVVBL2IxYW9nMUhMQUIxV0NvalBCb1h1dWp3cWoycDAxMVo2STJoeHhwRGJMK3FPNHdPdXlIMFdDejR3cFlmT3JKNklJN0hKaUFoYlJ0cDFLTHpxZXcwckRmM0hxM1hCMkpuZzBPalFnWHNNbUd1S0ZoYURuSzR4Qi9ab085UTRkRUgzekM5ellCM0VxZndscGN1RDlKMjdGTDZvU2FVb1l4cGJUcXkrVXhWUlBpWFlrVXVRUWNUNjFBQUZTdjFXd3hwdllQT1RSUU1tSGFDKzFsVkM0VjZnOU5UeG11UXJiaEVXWk1VOHhzY2orcjFLc21OWWRuclhkMitCbjJjUVlITjdSVHhJdTBJOUw0bHlseGRFWnRDZVhYSStkL0xSQllHTHZqSHpjM2RmZGtsd1AvT3N6T3ZRdGVhV1BBM1RkblNmZm1xRmkxR1Z3K0hkT09VSmlFVUJmNjJTMDlVbnVZSHNlU2pNYkREL2hpQi9QNTVVRXUyS1cvTW5EYUROUzJ6RFFxNUJ2WEt3d2M0VWFPaklKK2hFNE1TSGlZU3l3WW9QZjJ6clFrWHAxTlVWcTk1KzNwVDZoa0Z1aE54ZjdaTjNJNkNNMnpFVVNKdEJBaDhNb0pEVmJobDB5VnN0cEU3ZHBZMHNyenVoK0dQLzl3cE5TRFRFdk9VMmdMVnpiVHBCcGpDOWRWVGtSbzlrVW5FYkJ3SHRHNTJOMGhRcFJXeFlxcGZPUE1iV1BtSEF1L00vRnRKZGw4VDZUeU0yVDltajg0VExvRmU2V0t4WmwwQVBxeCtOQ0lSOXh6eWl1QVlzdXUrYzhUcEdQUklCSTR0R05sems5RGNtN2lFQStSVG54ZXkxNGZqTlBnWmg0QWpXZWtGL3RwNWVDUlV3dUVuNnRuUDdacXcrcmg4QWxsMm81YUNqQk5KZUR5akVJNEdpS3hDR1c5Q1Z5RE5JR3dCeDBTZkZjVE9NSHJZYjgydmROSzhxUTFBbjhqR2NTWGk0VzRPWEE5L3hGUTFwUkp4aVJwY0tqaTBHYnJXK2ZnWUVOTWVrYlJ1aGVmb3d5OUVPOFFsdksxNUNoRWVjS2ZRWGhMRXhXYUtFZFVyUW1QMVlMRVBQY0VZQi9ZZTNvUEQrMWRFS3NweGg5SloxOVpwbHB5bndMWjJtbmpwMWhtc1h6TGhNTWZ1S0VtZWJ2c09wMzZwaXJaZ0VFRklKa2hEVHNJVXQvQTRLZncwTmVoN0NtZGNFQjNUdDJnRk5Tb3hCNEpPbkpqU243SjdNc1pNQ1pka29pTVVGV0RnR2FzNk5RS0MvOW41TlN6c2NSZjVOWW5hVTVIS0xWZ0NSSXNwak5zQXA5end2TFY1SW5VekFOdHNOYkQ4ZVkvdnpuNmdIdEhaRHpMRzJMUTBWK000amRaeFFPQy9sOEJHSkw2UHFaa1RBeVY2OUR2WFY2ZEprK3BXdXlsS1djQUdOMHhSaWxFK2Z2SEFPMURPdmIveDUyMnZpTGswaDdHeGd1Y1p3bzRJSGRSZ2M1aEZuM1oyNGlqa1JsQ0hhQ1d2L0kzaUNkc1BqWFJacUdXcG81cGlpOUx4TVo0eW9MNWhERHo5ZkJXcWwwZkgxZEFERk83Tk9NcnppRkU0enB1UjhRVk1YSDdITC9tZE1GMGUxbTlaWlZIeHRKWjYvVmhqZjdKcy9WQTVlckdkUDd4YjlwTnRMczVaZmcxSnltajZFSm45L3ZsNDU4V2dzZTNkZTRiV2JVdTZkUXBwV1JtU1k3YVB4TlNnckFkTzVqM3pxbTcrNjRFWCtjdzgrZzRjWkhCMU9pRU5rY3lmUTlmQ3JleDFWTUpTZk1HUmRVdDNEZjNrdGJqbGtnU09RPT0=
--------------------------------------------------------------------------------
* DO NOT TRY TO RECOVER FILES YOURSELF!
* DO NOT MODIFY ENCRYPTED FILES!
* * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * *
c5
URLs
http://avaddonbotrxmuyl.onion
Signatures
-
Avaddon
Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (170) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe File opened (read-only) \??\U: cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe File opened (read-only) \??\V: cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe File opened (read-only) \??\W: cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe File opened (read-only) \??\F: cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe File opened (read-only) \??\J: cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe File opened (read-only) \??\K: cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe File opened (read-only) \??\X: cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe File opened (read-only) \??\A: cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe File opened (read-only) \??\B: cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe File opened (read-only) \??\I: cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe File opened (read-only) \??\L: cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe File opened (read-only) \??\P: cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe File opened (read-only) \??\R: cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe File opened (read-only) \??\S: cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe File opened (read-only) \??\Y: cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe File opened (read-only) \??\E: cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe File opened (read-only) \??\G: cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe File opened (read-only) \??\Z: cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe File opened (read-only) \??\O: cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe File opened (read-only) \??\Q: cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe File opened (read-only) \??\T: cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe File opened (read-only) \??\H: cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe File opened (read-only) \??\M: cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2740 vssadmin.exe 2536 vssadmin.exe 320 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2708 wmic.exe Token: SeSecurityPrivilege 2708 wmic.exe Token: SeTakeOwnershipPrivilege 2708 wmic.exe Token: SeLoadDriverPrivilege 2708 wmic.exe Token: SeSystemProfilePrivilege 2708 wmic.exe Token: SeSystemtimePrivilege 2708 wmic.exe Token: SeProfSingleProcessPrivilege 2708 wmic.exe Token: SeIncBasePriorityPrivilege 2708 wmic.exe Token: SeCreatePagefilePrivilege 2708 wmic.exe Token: SeBackupPrivilege 2708 wmic.exe Token: SeRestorePrivilege 2708 wmic.exe Token: SeShutdownPrivilege 2708 wmic.exe Token: SeDebugPrivilege 2708 wmic.exe Token: SeSystemEnvironmentPrivilege 2708 wmic.exe Token: SeRemoteShutdownPrivilege 2708 wmic.exe Token: SeUndockPrivilege 2708 wmic.exe Token: SeManageVolumePrivilege 2708 wmic.exe Token: 33 2708 wmic.exe Token: 34 2708 wmic.exe Token: 35 2708 wmic.exe Token: SeBackupPrivilege 2644 vssvc.exe Token: SeRestorePrivilege 2644 vssvc.exe Token: SeAuditPrivilege 2644 vssvc.exe Token: SeIncreaseQuotaPrivilege 2400 wmic.exe Token: SeSecurityPrivilege 2400 wmic.exe Token: SeTakeOwnershipPrivilege 2400 wmic.exe Token: SeLoadDriverPrivilege 2400 wmic.exe Token: SeSystemProfilePrivilege 2400 wmic.exe Token: SeSystemtimePrivilege 2400 wmic.exe Token: SeProfSingleProcessPrivilege 2400 wmic.exe Token: SeIncBasePriorityPrivilege 2400 wmic.exe Token: SeCreatePagefilePrivilege 2400 wmic.exe Token: SeBackupPrivilege 2400 wmic.exe Token: SeRestorePrivilege 2400 wmic.exe Token: SeShutdownPrivilege 2400 wmic.exe Token: SeDebugPrivilege 2400 wmic.exe Token: SeSystemEnvironmentPrivilege 2400 wmic.exe Token: SeRemoteShutdownPrivilege 2400 wmic.exe Token: SeUndockPrivilege 2400 wmic.exe Token: SeManageVolumePrivilege 2400 wmic.exe Token: 33 2400 wmic.exe Token: 34 2400 wmic.exe Token: 35 2400 wmic.exe Token: SeIncreaseQuotaPrivilege 2736 wmic.exe Token: SeSecurityPrivilege 2736 wmic.exe Token: SeTakeOwnershipPrivilege 2736 wmic.exe Token: SeLoadDriverPrivilege 2736 wmic.exe Token: SeSystemProfilePrivilege 2736 wmic.exe Token: SeSystemtimePrivilege 2736 wmic.exe Token: SeProfSingleProcessPrivilege 2736 wmic.exe Token: SeIncBasePriorityPrivilege 2736 wmic.exe Token: SeCreatePagefilePrivilege 2736 wmic.exe Token: SeBackupPrivilege 2736 wmic.exe Token: SeRestorePrivilege 2736 wmic.exe Token: SeShutdownPrivilege 2736 wmic.exe Token: SeDebugPrivilege 2736 wmic.exe Token: SeSystemEnvironmentPrivilege 2736 wmic.exe Token: SeRemoteShutdownPrivilege 2736 wmic.exe Token: SeUndockPrivilege 2736 wmic.exe Token: SeManageVolumePrivilege 2736 wmic.exe Token: 33 2736 wmic.exe Token: 34 2736 wmic.exe Token: 35 2736 wmic.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2948 wrote to memory of 2708 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 28 PID 2948 wrote to memory of 2708 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 28 PID 2948 wrote to memory of 2708 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 28 PID 2948 wrote to memory of 2708 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 28 PID 2948 wrote to memory of 2740 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 30 PID 2948 wrote to memory of 2740 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 30 PID 2948 wrote to memory of 2740 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 30 PID 2948 wrote to memory of 2740 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 30 PID 2948 wrote to memory of 2400 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 33 PID 2948 wrote to memory of 2400 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 33 PID 2948 wrote to memory of 2400 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 33 PID 2948 wrote to memory of 2400 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 33 PID 2948 wrote to memory of 2536 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 35 PID 2948 wrote to memory of 2536 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 35 PID 2948 wrote to memory of 2536 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 35 PID 2948 wrote to memory of 2536 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 35 PID 2948 wrote to memory of 2736 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 37 PID 2948 wrote to memory of 2736 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 37 PID 2948 wrote to memory of 2736 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 37 PID 2948 wrote to memory of 2736 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 37 PID 2948 wrote to memory of 320 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 39 PID 2948 wrote to memory of 320 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 39 PID 2948 wrote to memory of 320 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 39 PID 2948 wrote to memory of 320 2948 cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe 39 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe"C:\Users\Admin\AppData\Local\Temp\cc95a8d100f70d0fbf4af14e852aa108bdb0e36db4054c3f60b3515818a71f46.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2948 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2708
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:2740
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2400
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:2536
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:320
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2644
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5f29ff65dac267e79cdf3aea3947a6e75
SHA19cb98fc191a40c7f11d0057e5af0ffe6f4d2469f
SHA256c0931ea4d80e73749a438ed79f0c8a2a310e7016a4d30feb8cb0beb989be746f
SHA512401d1278ecfd0bb16a08f8c450e22a86a12477bb0c393fabe52c77a048b531941bddb218b8c667c48926c36559d943b9ea18f88f4b0e9ae19b9e59ebe4fc0b56