Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
29-04-2024 08:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
mimicransomware_enc_infected.exe
Resource
win7-20240419-en
windows7-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
mimicransomware_enc_infected.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
23 signatures
150 seconds
General
-
Target
mimicransomware_enc_infected.exe
-
Size
2.4MB
-
MD5
2a613d677cc3e2991dcd954e9413c40c
-
SHA1
26f49090585d31dca8dde83106c0a851f00f2f18
-
SHA256
c7adce3459f21a1afb62f779d8baaa2ea3e7614b8fa312ac67725d532c15c54b
-
SHA512
b3edc9f56aa9c1f3685bb7e14d7dad27f23346bb1f21618acb3091c2031c1c5f48f77f375d97763b2da1b4658efd12a1147114bd65190b9f8c772d302d0f7a44
-
SSDEEP
49152:I/oSNzCxuPz3v/EekOEQ5ZlC2WQcyDJFD6BaKAjB8eJMv+8KwXkZx+jau:I/oCCQv/EeJESlC2WbyDukrBDJMGXjG
Score
10/10
Malware Config
Signatures
-
Detects Mimic ransomware 1 IoCs
resource yara_rule behavioral1/files/0x00090000000134f5-5.dat family_mimic -
Mimic
Ransomware family was first exploited in the wild in 2022.
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" encrypt.exe -
Clears Windows event logs 1 TTPs 3 IoCs
pid Process 2044 wevtutil.exe 2604 wevtutil.exe 1364 wevtutil.exe -
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2492 bcdedit.exe 2032 bcdedit.exe -
pid Process 668 wbadmin.exe -
pid Process 476 wbadmin.exe -
Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SimplyConnectionManager.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-nt.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\r.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlservr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocautoupds.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocssd.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsnapvss.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\raw_agent_svc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sql.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineElevatedCfg.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_x64.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlservrs.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" encrypt.exe -
Executes dropped EXE 5 IoCs
pid Process 2832 encrypt.exe 2820 encrypt.exe 2564 encrypt.exe 2852 encrypt.exe 2720 encrypt.exe -
Loads dropped DLL 9 IoCs
pid Process 2176 mimicransomware_enc_infected.exe 2176 mimicransomware_enc_infected.exe 2176 mimicransomware_enc_infected.exe 2832 encrypt.exe 2832 encrypt.exe 2820 encrypt.exe 2852 encrypt.exe 2564 encrypt.exe 2720 encrypt.exe -
Modifies system executable filetype association 2 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" encrypt.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*" encrypt.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\open\command encrypt.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell encrypt.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\open encrypt.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command encrypt.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\open\command encrypt.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" encrypt.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*" encrypt.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\encrypt = "\"C:\\Users\\Admin\\AppData\\Local\\encrypt\\encrypt.exe\" " encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\encrypt.exe = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\HACKLENDINIZ.txt\"" encrypt.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: encrypt.exe File opened (read-only) \??\E: encrypt.exe File opened (read-only) \??\M: encrypt.exe File opened (read-only) \??\Q: encrypt.exe File opened (read-only) \??\S: encrypt.exe File opened (read-only) \??\T: encrypt.exe File opened (read-only) \??\V: encrypt.exe File opened (read-only) \??\Y: encrypt.exe File opened (read-only) \??\A: encrypt.exe File opened (read-only) \??\J: encrypt.exe File opened (read-only) \??\L: encrypt.exe File opened (read-only) \??\O: encrypt.exe File opened (read-only) \??\P: encrypt.exe File opened (read-only) \??\G: encrypt.exe File opened (read-only) \??\U: encrypt.exe File opened (read-only) \??\W: encrypt.exe File opened (read-only) \??\H: encrypt.exe File opened (read-only) \??\I: encrypt.exe File opened (read-only) \??\K: encrypt.exe File opened (read-only) \??\N: encrypt.exe File opened (read-only) \??\R: encrypt.exe File opened (read-only) \??\X: encrypt.exe File opened (read-only) \??\Z: encrypt.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl wbadmin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 11 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\open encrypt.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*" encrypt.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*" encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" encrypt.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell encrypt.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile encrypt.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command encrypt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" encrypt.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\open\command encrypt.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command encrypt.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\exefile\shell\open\command encrypt.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 628 notepad.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 2852 encrypt.exe 2720 encrypt.exe 2820 encrypt.exe 2820 encrypt.exe 2820 encrypt.exe 2820 encrypt.exe 2820 encrypt.exe 2820 encrypt.exe 2820 encrypt.exe 2820 encrypt.exe 2820 encrypt.exe 2820 encrypt.exe 2820 encrypt.exe 2820 encrypt.exe 2820 encrypt.exe 2820 encrypt.exe 2820 encrypt.exe 2820 encrypt.exe 2820 encrypt.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2832 encrypt.exe Token: SeSecurityPrivilege 2832 encrypt.exe Token: SeTakeOwnershipPrivilege 2832 encrypt.exe Token: SeLoadDriverPrivilege 2832 encrypt.exe Token: SeSystemProfilePrivilege 2832 encrypt.exe Token: SeSystemtimePrivilege 2832 encrypt.exe Token: SeProfSingleProcessPrivilege 2832 encrypt.exe Token: SeIncBasePriorityPrivilege 2832 encrypt.exe Token: SeCreatePagefilePrivilege 2832 encrypt.exe Token: SeBackupPrivilege 2832 encrypt.exe Token: SeRestorePrivilege 2832 encrypt.exe Token: SeShutdownPrivilege 2832 encrypt.exe Token: SeDebugPrivilege 2832 encrypt.exe Token: SeSystemEnvironmentPrivilege 2832 encrypt.exe Token: SeChangeNotifyPrivilege 2832 encrypt.exe Token: SeRemoteShutdownPrivilege 2832 encrypt.exe Token: SeUndockPrivilege 2832 encrypt.exe Token: SeManageVolumePrivilege 2832 encrypt.exe Token: SeImpersonatePrivilege 2832 encrypt.exe Token: SeCreateGlobalPrivilege 2832 encrypt.exe Token: 33 2832 encrypt.exe Token: 34 2832 encrypt.exe Token: 35 2832 encrypt.exe Token: SeIncreaseQuotaPrivilege 2820 encrypt.exe Token: SeSecurityPrivilege 2820 encrypt.exe Token: SeTakeOwnershipPrivilege 2820 encrypt.exe Token: SeLoadDriverPrivilege 2820 encrypt.exe Token: SeSystemProfilePrivilege 2820 encrypt.exe Token: SeSystemtimePrivilege 2820 encrypt.exe Token: SeProfSingleProcessPrivilege 2820 encrypt.exe Token: SeIncBasePriorityPrivilege 2820 encrypt.exe Token: SeCreatePagefilePrivilege 2820 encrypt.exe Token: SeBackupPrivilege 2820 encrypt.exe Token: SeRestorePrivilege 2820 encrypt.exe Token: SeShutdownPrivilege 2820 encrypt.exe Token: SeDebugPrivilege 2820 encrypt.exe Token: SeSystemEnvironmentPrivilege 2820 encrypt.exe Token: SeChangeNotifyPrivilege 2820 encrypt.exe Token: SeRemoteShutdownPrivilege 2820 encrypt.exe Token: SeUndockPrivilege 2820 encrypt.exe Token: SeManageVolumePrivilege 2820 encrypt.exe Token: SeImpersonatePrivilege 2820 encrypt.exe Token: SeCreateGlobalPrivilege 2820 encrypt.exe Token: 33 2820 encrypt.exe Token: 34 2820 encrypt.exe Token: 35 2820 encrypt.exe Token: SeIncreaseQuotaPrivilege 2852 encrypt.exe Token: SeSecurityPrivilege 2852 encrypt.exe Token: SeTakeOwnershipPrivilege 2852 encrypt.exe Token: SeLoadDriverPrivilege 2852 encrypt.exe Token: SeSystemProfilePrivilege 2852 encrypt.exe Token: SeSystemtimePrivilege 2852 encrypt.exe Token: SeProfSingleProcessPrivilege 2852 encrypt.exe Token: SeIncBasePriorityPrivilege 2852 encrypt.exe Token: SeCreatePagefilePrivilege 2852 encrypt.exe Token: SeBackupPrivilege 2852 encrypt.exe Token: SeRestorePrivilege 2852 encrypt.exe Token: SeShutdownPrivilege 2852 encrypt.exe Token: SeDebugPrivilege 2852 encrypt.exe Token: SeSystemEnvironmentPrivilege 2852 encrypt.exe Token: SeChangeNotifyPrivilege 2852 encrypt.exe Token: SeRemoteShutdownPrivilege 2852 encrypt.exe Token: SeUndockPrivilege 2852 encrypt.exe Token: SeManageVolumePrivilege 2852 encrypt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2176 wrote to memory of 2832 2176 mimicransomware_enc_infected.exe 28 PID 2176 wrote to memory of 2832 2176 mimicransomware_enc_infected.exe 28 PID 2176 wrote to memory of 2832 2176 mimicransomware_enc_infected.exe 28 PID 2176 wrote to memory of 2832 2176 mimicransomware_enc_infected.exe 28 PID 2832 wrote to memory of 2820 2832 encrypt.exe 29 PID 2832 wrote to memory of 2820 2832 encrypt.exe 29 PID 2832 wrote to memory of 2820 2832 encrypt.exe 29 PID 2832 wrote to memory of 2820 2832 encrypt.exe 29 PID 2820 wrote to memory of 2564 2820 encrypt.exe 30 PID 2820 wrote to memory of 2564 2820 encrypt.exe 30 PID 2820 wrote to memory of 2564 2820 encrypt.exe 30 PID 2820 wrote to memory of 2564 2820 encrypt.exe 30 PID 2820 wrote to memory of 2852 2820 encrypt.exe 31 PID 2820 wrote to memory of 2852 2820 encrypt.exe 31 PID 2820 wrote to memory of 2852 2820 encrypt.exe 31 PID 2820 wrote to memory of 2852 2820 encrypt.exe 31 PID 2820 wrote to memory of 2720 2820 encrypt.exe 32 PID 2820 wrote to memory of 2720 2820 encrypt.exe 32 PID 2820 wrote to memory of 2720 2820 encrypt.exe 32 PID 2820 wrote to memory of 2720 2820 encrypt.exe 32 PID 2820 wrote to memory of 2844 2820 encrypt.exe 33 PID 2820 wrote to memory of 2844 2820 encrypt.exe 33 PID 2820 wrote to memory of 2844 2820 encrypt.exe 33 PID 2820 wrote to memory of 2844 2820 encrypt.exe 33 PID 2820 wrote to memory of 2908 2820 encrypt.exe 34 PID 2820 wrote to memory of 2908 2820 encrypt.exe 34 PID 2820 wrote to memory of 2908 2820 encrypt.exe 34 PID 2820 wrote to memory of 2908 2820 encrypt.exe 34 PID 2820 wrote to memory of 2936 2820 encrypt.exe 35 PID 2820 wrote to memory of 2936 2820 encrypt.exe 35 PID 2820 wrote to memory of 2936 2820 encrypt.exe 35 PID 2820 wrote to memory of 2936 2820 encrypt.exe 35 PID 2820 wrote to memory of 2916 2820 encrypt.exe 36 PID 2820 wrote to memory of 2916 2820 encrypt.exe 36 PID 2820 wrote to memory of 2916 2820 encrypt.exe 36 PID 2820 wrote to memory of 2916 2820 encrypt.exe 36 PID 2820 wrote to memory of 3028 2820 encrypt.exe 39 PID 2820 wrote to memory of 3028 2820 encrypt.exe 39 PID 2820 wrote to memory of 3028 2820 encrypt.exe 39 PID 2820 wrote to memory of 3028 2820 encrypt.exe 39 PID 2820 wrote to memory of 2568 2820 encrypt.exe 40 PID 2820 wrote to memory of 2568 2820 encrypt.exe 40 PID 2820 wrote to memory of 2568 2820 encrypt.exe 40 PID 2820 wrote to memory of 2568 2820 encrypt.exe 40 PID 2820 wrote to memory of 2272 2820 encrypt.exe 42 PID 2820 wrote to memory of 2272 2820 encrypt.exe 42 PID 2820 wrote to memory of 2272 2820 encrypt.exe 42 PID 2820 wrote to memory of 2272 2820 encrypt.exe 42 PID 2820 wrote to memory of 2452 2820 encrypt.exe 43 PID 2820 wrote to memory of 2452 2820 encrypt.exe 43 PID 2820 wrote to memory of 2452 2820 encrypt.exe 43 PID 2820 wrote to memory of 2452 2820 encrypt.exe 43 PID 2820 wrote to memory of 2516 2820 encrypt.exe 44 PID 2820 wrote to memory of 2516 2820 encrypt.exe 44 PID 2820 wrote to memory of 2516 2820 encrypt.exe 44 PID 2820 wrote to memory of 2516 2820 encrypt.exe 44 PID 2820 wrote to memory of 2840 2820 encrypt.exe 45 PID 2820 wrote to memory of 2840 2820 encrypt.exe 45 PID 2820 wrote to memory of 2840 2820 encrypt.exe 45 PID 2820 wrote to memory of 2840 2820 encrypt.exe 45 PID 2820 wrote to memory of 2636 2820 encrypt.exe 46 PID 2820 wrote to memory of 2636 2820 encrypt.exe 46 PID 2820 wrote to memory of 2636 2820 encrypt.exe 46 PID 2820 wrote to memory of 2636 2820 encrypt.exe 46 -
System policy modification 1 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0" encrypt.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer encrypt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System encrypt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" encrypt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection encrypt.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\mimicransomware_enc_infected.exe"C:\Users\Admin\AppData\Local\Temp\mimicransomware_enc_infected.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\tempcrc\encrypt.exe"C:\tempcrc\encrypt.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\encrypt\encrypt.exe"C:\Users\Admin\AppData\Local\encrypt\encrypt.exe"3⤵
- Modifies security service
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2820 -
C:\Users\Admin\AppData\Local\encrypt\encrypt.exe"C:\Users\Admin\AppData\Local\encrypt\encrypt.exe" -e watch -pid 2820 -!4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564
-
-
C:\Users\Admin\AppData\Local\encrypt\encrypt.exe"C:\Users\Admin\AppData\Local\encrypt\encrypt.exe" -e ul14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2852
-
-
C:\Users\Admin\AppData\Local\encrypt\encrypt.exe"C:\Users\Admin\AppData\Local\encrypt\encrypt.exe" -e ul24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2720
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -H off4⤵PID:2844
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:2908
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:2936
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:2916
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:3028
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:2568
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:2272
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:2452
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:2516
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:2840
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:2636
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:1624
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:2640
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c4⤵PID:1660
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb614⤵PID:1972
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:2492
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:2032
-
-
C:\Windows\system32\wbadmin.exewbadmin.exe DELETE SYSTEMSTATEBACKUP4⤵
- Deletes System State backups
- Drops file in Windows directory
PID:668
-
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet4⤵
- Deletes backup catalog
PID:476
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe "C:\Users\Admin\AppData\Local\HACKLENDINIZ.txt"4⤵
- Opens file in notepad (likely ransom note)
PID:628
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl security4⤵
- Clears Windows event logs
PID:2044
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl system4⤵
- Clears Windows event logs
PID:2604
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl application4⤵
- Clears Windows event logs
PID:1364
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:1436
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:1036
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:908
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:2012
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c2f9c70d979738f5172ea3408ce672d8
SHA10ff7d5760a755080940a896897ff9ce3b130d7ab
SHA2566d37336074d64982f2e8152bd1e411c1cb3df970d0806744a08799d747ff024b
SHA5123a6346dacc1638cee1bad5d0316b0fe42f132e92d63e3e42d70a217329f9f5ed4df6765c59cf3a0a5e79146709ababc6aa167a9602aeb074b3116bf5fbe3c646
-
Filesize
32B
MD5f1087703a67703c59517de1974f9cca9
SHA1e07233c720442b72659d7701ac3c5bd46436613c
SHA25617053228ad80e2fa6c0f08722011148a4ff4c56d0adfb32fea801809a4dfdc3b
SHA5129acd12695125393478eb643a985dd934445d86c89d6b50cdb9337bc920dd840998c5d0ec686c9b8147fad5129b0d7811d3b66a181bb7d15fa13ba4535dca9e0a
-
Filesize
84KB
MD53b03324537327811bbbaff4aafa4d75b
SHA11218bd8165a2e0ec56a88b5a8bb4b27e52b564e7
SHA2568cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
SHA512ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62
-
Filesize
3.0MB
MD5a48ee000e248741247c24dc70fa2f936
SHA14c814fe7c94e6fb4d1d89cdae7e6e83905c459d7
SHA256bb28adc32ff1b9dcfaac6b7017b4896d2807b48080f9e6720afde3f89d69676c
SHA5128bdd60732bf105b9ade5d4dbc5c722a866119e0a284692afc1bd5b530a4afc3954536a14946a87f72213c92020def2ac7b5c1cbcc51b6e0ad5671b7c58543f34