Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
31-05-2024 05:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe
Resource
win7-20240419-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
21 signatures
150 seconds
General
-
Target
e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe
-
Size
814KB
-
MD5
ff332804aecbdc92dd6cb40e79e3a5c2
-
SHA1
7bf583928799d13465905e4fba442aaf65e0faef
-
SHA256
e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0
-
SHA512
f5e454cf102335e3170d88876519d5042b4a5a8695fcc1261df53a1911e2f1a1071d8e3fe0ffdc675a7edb9002363a9f4e62519a518ee62108ba80b2d46d311d
-
SSDEEP
24576:ghwjO7VHnC/Nj7XzHsiLEPw55Wvt5AQJunXP:ghwjx/NjEOEo2v/A5XP
Malware Config
Extracted
Path
C:\Program Files\Java\jdk1.7.0_80\db\Restore-My-Files.txt
Ransom Note
LockBit 2.0 Ransomware
Your data are stolen and encrypted
The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom
You can contact us and decrypt one file for free on these TOR sites
http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
OR
https://decoding.at
Decryption ID: BF515FB0351DCD6E7FC2338EFED9D9DF
URLs
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
https://bigblog.at
http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
https://decoding.at
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid Process 1108 bcdedit.exe 2780 bcdedit.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\{36517AB0-1D1D-CDD0-59DD-59F01474E9CD} = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe\"" e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exedescription ioc Process File opened (read-only) \??\F: e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe -
Drops file in System32 directory 1 IoCs
Processes:
e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exedescription ioc Process File created C:\windows\SysWOW64\BF515F.ico e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 21 IoCs
Processes:
e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exepid Process 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe -
Drops file in Program Files directory 64 IoCs
Processes:
e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exedescription ioc Process File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\ph02058u.bmp e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\ph02810j.jpg e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\microsoft office\office14\pubwiz\dgatnget.xml e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\shatter\203x8subpicture.png e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\videolan\vlc\locale\ru\lc_messages\vlc.mo e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\windows sidebar\gadgets\picturepuzzle.gadget\images\2.png e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\microsoft office\office14\pubwiz\invite11.poc e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\config\modules\org-netbeans-modules-favorites.xml e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\windows sidebar\gadgets\currency.gadget\images\info.png e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\resizingpanels\navigationup_buttongraphic.png e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\windows sidebar\gadgets\weather.gadget\it-it\css\localizedsettings.css e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0196364.wmf e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\ph02040u.bmp e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\microsoft office\document themes 14\theme effects\hardcover.eftx e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File created C:\program files (x86)\microsoft office\office14\accessweb\Restore-My-Files.txt e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms3\formsstyles\lightspirit.css e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\videolan\vlc\lua\intf\modules\host.luac e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\videolan\vlc\lua\playlist\rockbox_fm_presets.luac e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\boat.wmf e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\na02041_.wmf e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\microsoft office\office14\3082\mso.acl e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_zh_cn.jar e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\windows sidebar\gadgets\calendar.gadget\images\calendar_double_orange.png e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\windows sidebar\gadgets\mediacenter.gadget\images\button_left_mouseover.png e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\microsoft office\office14\forms\1033\omsmms.cfg e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\microsoft office\office14\pubwiz\greet11.poc e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\flippage\navigationleft_selectionsubpicture.png e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\zi\america\martinique e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\microsoft office\office14\1033\setlang_col.hxt e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\currency.gadget\en-us\js\currency.js e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.ja_5.5.0.165303.jar e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0145373.jpg e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\weather.gadget\images\28.png e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\microsoft office\media\office14\autoshap\bd18212_.wmf e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\assemblyinfointernal.zip e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\windows sidebar\gadgets\picturepuzzle.gadget\images\settings_divider_left.png e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\hh00526_.wmf e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\tn00246_.wmf e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\weather.gadget\images\16.png e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\visualvm\platform\config\modules\org-netbeans-modules-masterfs.xml e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File created C:\program files\videolan\vlc\locale\hu\lc_messages\Restore-My-Files.txt e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\windows sidebar\gadgets\cpu.gadget\fr-fr\cpu.html e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\hh01618_.wmf e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\sl01395_.wmf e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\microsoft office\office14\outlookautodiscover\yahoo.co.in.xml e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\clock.gadget\images\trad_settings.png e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.zh_cn_5.5.0.165303.jar e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\java\jre7\lib\zi\asia\ho_chi_minh e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\videolan\vlc\locale\hr\lc_messages\vlc.mo e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0103812.wmf e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\j0382958.jpg e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\microsoft office\office14\pagesize\pgmn089.xml e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\weather.gadget\es-es\js\localizedstrings.js e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\dvd maker\shared\dvdstyles\pets\pets_image-frame-backglow.png e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\tools.jar e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\windows sidebar\gadgets\weather.gadget\images\28.png e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\microsoft office\clipart\pub60cor\jngle_01.mid e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files (x86)\windows sidebar\gadgets\rssfeeds.gadget\es-es\js\settings.js e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\7-zip\lang\is.txt e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\java\jdk1.7.0_80\jre\lib\zi\america\panama e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.identity_3.4.0.v20140827-1444.jar e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\java\jre7\lib\zi\europe\rome e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe File opened for modification C:\program files\windows sidebar\gadgets\rssfeeds.gadget\de-de\flyout.html e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid Process 2428 vssadmin.exe -
Modifies registry class 3 IoCs
Processes:
e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exedescription ioc Process Key created \Registry\Machine\Software\Classes\.lockbit\DefaultIcon e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lockbit\DefaultIcon\ = "C:\\windows\\SysWow64\\BF515F.ico" e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe Key created \Registry\Machine\Software\Classes\.lockbit e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exepid Process 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exevssvc.exeWMIC.exedescription pid Process Token: SeTakeOwnershipPrivilege 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe Token: SeDebugPrivilege 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe Token: SeBackupPrivilege 1788 vssvc.exe Token: SeRestorePrivilege 1788 vssvc.exe Token: SeAuditPrivilege 1788 vssvc.exe Token: SeIncreaseQuotaPrivilege 2028 WMIC.exe Token: SeSecurityPrivilege 2028 WMIC.exe Token: SeTakeOwnershipPrivilege 2028 WMIC.exe Token: SeLoadDriverPrivilege 2028 WMIC.exe Token: SeSystemProfilePrivilege 2028 WMIC.exe Token: SeSystemtimePrivilege 2028 WMIC.exe Token: SeProfSingleProcessPrivilege 2028 WMIC.exe Token: SeIncBasePriorityPrivilege 2028 WMIC.exe Token: SeCreatePagefilePrivilege 2028 WMIC.exe Token: SeBackupPrivilege 2028 WMIC.exe Token: SeRestorePrivilege 2028 WMIC.exe Token: SeShutdownPrivilege 2028 WMIC.exe Token: SeDebugPrivilege 2028 WMIC.exe Token: SeSystemEnvironmentPrivilege 2028 WMIC.exe Token: SeRemoteShutdownPrivilege 2028 WMIC.exe Token: SeUndockPrivilege 2028 WMIC.exe Token: SeManageVolumePrivilege 2028 WMIC.exe Token: 33 2028 WMIC.exe Token: 34 2028 WMIC.exe Token: 35 2028 WMIC.exe Token: SeIncreaseQuotaPrivilege 2028 WMIC.exe Token: SeSecurityPrivilege 2028 WMIC.exe Token: SeTakeOwnershipPrivilege 2028 WMIC.exe Token: SeLoadDriverPrivilege 2028 WMIC.exe Token: SeSystemProfilePrivilege 2028 WMIC.exe Token: SeSystemtimePrivilege 2028 WMIC.exe Token: SeProfSingleProcessPrivilege 2028 WMIC.exe Token: SeIncBasePriorityPrivilege 2028 WMIC.exe Token: SeCreatePagefilePrivilege 2028 WMIC.exe Token: SeBackupPrivilege 2028 WMIC.exe Token: SeRestorePrivilege 2028 WMIC.exe Token: SeShutdownPrivilege 2028 WMIC.exe Token: SeDebugPrivilege 2028 WMIC.exe Token: SeSystemEnvironmentPrivilege 2028 WMIC.exe Token: SeRemoteShutdownPrivilege 2028 WMIC.exe Token: SeUndockPrivilege 2028 WMIC.exe Token: SeManageVolumePrivilege 2028 WMIC.exe Token: 33 2028 WMIC.exe Token: 34 2028 WMIC.exe Token: 35 2028 WMIC.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.execmd.exedescription pid Process procid_target PID 1992 wrote to memory of 316 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 28 PID 1992 wrote to memory of 316 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 28 PID 1992 wrote to memory of 316 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 28 PID 1992 wrote to memory of 316 1992 e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe 28 PID 316 wrote to memory of 2428 316 cmd.exe 31 PID 316 wrote to memory of 2428 316 cmd.exe 31 PID 316 wrote to memory of 2428 316 cmd.exe 31 PID 316 wrote to memory of 2028 316 cmd.exe 34 PID 316 wrote to memory of 2028 316 cmd.exe 34 PID 316 wrote to memory of 2028 316 cmd.exe 34 PID 316 wrote to memory of 1108 316 cmd.exe 36 PID 316 wrote to memory of 1108 316 cmd.exe 36 PID 316 wrote to memory of 1108 316 cmd.exe 36 PID 316 wrote to memory of 2780 316 cmd.exe 37 PID 316 wrote to memory of 2780 316 cmd.exe 37 PID 316 wrote to memory of 2780 316 cmd.exe 37 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe"C:\Users\Admin\AppData\Local\Temp\e68a16ad68d27165929ef7d7b259d1d85cfb766f167b4853c1c2bb3c508c12a0.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2428
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:1108
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2780
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1788
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD57d2ad5a77a4873bca8666d8febe033a9
SHA16e8109be8f72f4389d09f103f1f0e40e12dddeb9
SHA256e28e5e2e699f0f1c0f0f54fa50b984ea07be494511bc9ef2d05dce8bee7143d3
SHA5129dcc785610bc40bce37da1186bc3f674c3efc0b572e46c569d0cff48c54ad5585e4c9c9d68fbca5847313975a00bd24a4f9bc29cb119ab5e9660057fb6b0ef6c