Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
05-07-2024 09:52
Behavioral task
behavioral1
Sample
528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe
Resource
win10v2004-20240704-en
General
-
Target
528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe
-
Size
1.3MB
-
MD5
9e6c3801e0ac1c1fee4150e48777f3f6
-
SHA1
1e21dd960332e36051244fcc8180fa62a87d889d
-
SHA256
528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263
-
SHA512
73f114f6a31e9a8267086b80c731c30a9c0808a775bdcf07b1fae439da79f789b4fdf2d1a0ef8906e8cd0139f85fc47bf7c76e4bf81753b4670c8cb777883845
-
SSDEEP
12288:QmHAIqyfF/5ebyz1dpPlRnMRTD410ALP68kG3Jz4S9FUmnyJtgoiOHmabd8ornXz:HHRFfauvpPXnMKqJtfiOHmUd8QTHj
Malware Config
Extracted
C:\Users\Admin\!!!HOW_TO_DECRYPT!!!.mht
[email protected]<BR>[email protected]<BR>In
http-equiv=3D"X
Signatures
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 1500 bcdedit.exe 1184 bcdedit.exe -
Renames multiple (897) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 1524 wbadmin.exe 1256 wbadmin.exe -
Drops file in Drivers directory 13 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File created C:\Windows\System32\drivers\etc\!!!HOW_TO_DECRYPT!!!.mht 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\drivers\etc\protocol 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\drivers\etc\protocol.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\drivers\etc\services 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\drivers\etc\hosts 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\drivers\etc\protocol.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\drivers\etc\services.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\drivers\etc\hosts.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\drivers\etc\networks 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\drivers\etc\networks.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\drivers\etc\networks.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\drivers\etc\services.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe -
Deletes itself 1 IoCs
pid Process 2844 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSFEEditor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe\" e" 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\E:\$RECYCLE.BIN\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe -
Enumerates connected drives 3 TTPs 39 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\U: 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened (read-only) \??\Y: 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened (read-only) \??\F: 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\S: 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened (read-only) \??\E: 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\I: 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened (read-only) \??\Q: 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened (read-only) \??\Z: 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\G: 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened (read-only) \??\R: 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened (read-only) \??\W: 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened (read-only) \??\X: 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\L: 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened (read-only) \??\O: 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened (read-only) \??\D: 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\B: 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened (read-only) \??\M: 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened (read-only) \??\P: 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened (read-only) \??\K: 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened (read-only) \??\V: 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\A: 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened (read-only) \??\J: 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\H: 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened (read-only) \??\N: 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened (read-only) \??\T: 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\config\DEFAULT 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File created C:\Windows\System32\Microsoft\Protect\S-1-5-18\!!!HOW_TO_DECRYPT!!!.mht 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\config\SOFTWARE 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\config\RegBack\DEFAULT 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\config\RegBack\SYSTEM 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\Preferred.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\f22e410f-f947-4e08-8f2a-8f65df603f8d 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\!!!HOW_TO_DECRYPT!!!.mht 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\1e582198-061f-43f1-abdf-d4e9b606b035.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\1e582198-061f-43f1-abdf-d4e9b606b035.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\f22e410f-f947-4e08-8f2a-8f65df603f8d.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File created C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\!!!HOW_TO_DECRYPT!!!.mht 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File created C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\!!!HOW_TO_DECRYPT!!!.mht 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\config\BCD-Template.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File created C:\Windows\System32\config\RegBack\!!!HOW_TO_DECRYPT!!!.mht 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\237b389d-8851-4f5d-ae3e-4365e8e78b9b 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\b889ab5d-f7d2-47ff-92a1-3ec877b7e01c.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\!!!HOW_TO_DECRYPT!!!.mht 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\config\SYSTEM 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\config\RegBack\SECURITY 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\85fe6f29-f646-4efb-ade4-2ba61fcbb9b4.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\b889ab5d-f7d2-47ff-92a1-3ec877b7e01c 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\67e717b7-3bed-405c-9193-9e2881e30b96.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\85fe6f29-f646-4efb-ade4-2ba61fcbb9b4.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\config\RegBack\SOFTWARE 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File created C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\!!!HOW_TO_DECRYPT!!!.mht 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\Preferred.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\config\BCD-Template 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\config\SAM 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File created C:\Windows\System32\LogFiles\Scm\!!!HOW_TO_DECRYPT!!!.mht 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File created C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\!!!HOW_TO_DECRYPT!!!.mht 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File created C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\!!!HOW_TO_DECRYPT!!!.mht 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File created C:\Windows\System32\config\!!!HOW_TO_DECRYPT!!!.mht 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\config\COMPONENTS.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\config\SECURITY 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\config\RegBack\SAM 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\Preferred 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\LogFiles\Scm\4c8b01a2-11ff-4c41-848f-508ef4f00cf7.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\Preferred.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\config\COMPONENTS.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\237b389d-8851-4f5d-ae3e-4365e8e78b9b.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre7\lib\zi\EET.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\security\cacerts 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Shanghai.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Bogota.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Resolute.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Chatham 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Pago_Pago.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\LICENSE.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Algiers.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Syowa 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Qatar 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Riga.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\!!!HOW_TO_DECRYPT!!!.mht 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Faroe.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\!!!HOW_TO_DECRYPT!!!.mht 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\UTC.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Center 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+1 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vevay.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Mozilla Firefox\removed-files.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\COPYRIGHT.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Ashgabat.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Atikokan.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Havana.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Cocos.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Toronto 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Yellowknife.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Algiers.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kathmandu 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Godthab.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Gibraltar.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Montreal.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Dublin 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Knox 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\New_Salem 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Mozilla Firefox\postSigningData.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Aqtobe.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Cayenne.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Manila.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-1 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-10.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\release 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\DumontDUrville.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Anadyr 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Cairo.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kathmandu.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Easter.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Mendoza.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Dubai.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Jayapura.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Tahiti.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\EST5EDT.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Gambier.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Almaty.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kamchatka.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Cuiaba.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Metlakatla.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Funafuti.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\GMT.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\MST.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Copenhagen.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+9.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Enderbury.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Bissau 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe -
Drops file in Windows directory 50 IoCs
description ioc Process File opened for modification C:\Windows\Panther\setupinfo 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\Boot\DVD\EFI\BCD 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\Boot\DVD\PCAT\BCD 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1cb2 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl wbadmin.exe File created C:\Windows\Boot\DVD\EFI\!!!HOW_TO_DECRYPT!!!.mht 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2cb2 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1th1 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2th2 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\alloc_2 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\Panther\setupinfo.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\state.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1th0 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1th2 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2th0 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\absthr_1 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\!!!HOW_TO_DECRYPT!!!.mht 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl wbadmin.exe File opened for modification C:\Windows\Panther\setupinfo.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\absthr_2 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\alloc_0 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\enwindow 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File created C:\Windows\Panther\!!!HOW_TO_DECRYPT!!!.mht 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\alloc_3 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl wbadmin.exe File opened for modification C:\Windows\Boot\PCAT\bootmgr 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2th1 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\alloc_1 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\state.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1cb1 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\!!!HOW_TO_DECRYPT!!!.mht 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File created C:\Windows\ehome\CreateDisc\Components\tables\!!!HOW_TO_DECRYPT!!!.mht 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl wbadmin.exe File created C:\Windows\Boot\DVD\PCAT\!!!HOW_TO_DECRYPT!!!.mht 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357.1btc 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2cb1 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\state 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357.inprocess 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File created C:\Windows\Boot\PCAT\!!!HOW_TO_DECRYPT!!!.mht 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\1cb0 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\2cb0 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\absthr_0 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File opened for modification C:\Windows\ehome\CreateDisc\Components\tables\dewindow 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe File created C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\cbshandler\!!!HOW_TO_DECRYPT!!!.mht 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 3 TTPs 13 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2760 vssadmin.exe 2612 vssadmin.exe 2364 vssadmin.exe 2636 vssadmin.exe 2548 vssadmin.exe 1628 vssadmin.exe 2580 vssadmin.exe 2576 vssadmin.exe 2028 vssadmin.exe 2564 vssadmin.exe 1608 vssadmin.exe 2136 vssadmin.exe 1636 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeBackupPrivilege 2732 vssvc.exe Token: SeRestorePrivilege 2732 vssvc.exe Token: SeAuditPrivilege 2732 vssvc.exe Token: SeIncreaseQuotaPrivilege 2300 wmic.exe Token: SeSecurityPrivilege 2300 wmic.exe Token: SeTakeOwnershipPrivilege 2300 wmic.exe Token: SeLoadDriverPrivilege 2300 wmic.exe Token: SeSystemProfilePrivilege 2300 wmic.exe Token: SeSystemtimePrivilege 2300 wmic.exe Token: SeProfSingleProcessPrivilege 2300 wmic.exe Token: SeIncBasePriorityPrivilege 2300 wmic.exe Token: SeCreatePagefilePrivilege 2300 wmic.exe Token: SeBackupPrivilege 2300 wmic.exe Token: SeRestorePrivilege 2300 wmic.exe Token: SeShutdownPrivilege 2300 wmic.exe Token: SeDebugPrivilege 2300 wmic.exe Token: SeSystemEnvironmentPrivilege 2300 wmic.exe Token: SeRemoteShutdownPrivilege 2300 wmic.exe Token: SeUndockPrivilege 2300 wmic.exe Token: SeManageVolumePrivilege 2300 wmic.exe Token: 33 2300 wmic.exe Token: 34 2300 wmic.exe Token: 35 2300 wmic.exe -
Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 2944 wrote to memory of 2136 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 28 PID 2944 wrote to memory of 2136 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 28 PID 2944 wrote to memory of 2136 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 28 PID 2944 wrote to memory of 2636 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 33 PID 2944 wrote to memory of 2636 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 33 PID 2944 wrote to memory of 2636 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 33 PID 2944 wrote to memory of 2548 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 35 PID 2944 wrote to memory of 2548 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 35 PID 2944 wrote to memory of 2548 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 35 PID 2944 wrote to memory of 2580 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 37 PID 2944 wrote to memory of 2580 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 37 PID 2944 wrote to memory of 2580 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 37 PID 2944 wrote to memory of 2576 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 39 PID 2944 wrote to memory of 2576 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 39 PID 2944 wrote to memory of 2576 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 39 PID 2944 wrote to memory of 2760 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 41 PID 2944 wrote to memory of 2760 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 41 PID 2944 wrote to memory of 2760 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 41 PID 2944 wrote to memory of 1628 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 43 PID 2944 wrote to memory of 1628 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 43 PID 2944 wrote to memory of 1628 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 43 PID 2944 wrote to memory of 2612 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 45 PID 2944 wrote to memory of 2612 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 45 PID 2944 wrote to memory of 2612 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 45 PID 2944 wrote to memory of 2564 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 47 PID 2944 wrote to memory of 2564 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 47 PID 2944 wrote to memory of 2564 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 47 PID 2944 wrote to memory of 2364 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 49 PID 2944 wrote to memory of 2364 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 49 PID 2944 wrote to memory of 2364 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 49 PID 2944 wrote to memory of 1608 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 51 PID 2944 wrote to memory of 1608 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 51 PID 2944 wrote to memory of 1608 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 51 PID 2944 wrote to memory of 1636 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 53 PID 2944 wrote to memory of 1636 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 53 PID 2944 wrote to memory of 1636 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 53 PID 2944 wrote to memory of 2028 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 55 PID 2944 wrote to memory of 2028 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 55 PID 2944 wrote to memory of 2028 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 55 PID 2944 wrote to memory of 1500 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 57 PID 2944 wrote to memory of 1500 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 57 PID 2944 wrote to memory of 1500 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 57 PID 2944 wrote to memory of 1184 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 59 PID 2944 wrote to memory of 1184 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 59 PID 2944 wrote to memory of 1184 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 59 PID 2944 wrote to memory of 1524 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 61 PID 2944 wrote to memory of 1524 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 61 PID 2944 wrote to memory of 1524 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 61 PID 2944 wrote to memory of 1256 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 63 PID 2944 wrote to memory of 1256 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 63 PID 2944 wrote to memory of 1256 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 63 PID 2944 wrote to memory of 2300 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 65 PID 2944 wrote to memory of 2300 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 65 PID 2944 wrote to memory of 2300 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 65 PID 2944 wrote to memory of 2844 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 68 PID 2944 wrote to memory of 2844 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 68 PID 2944 wrote to memory of 2844 2944 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe 68 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe"C:\Users\Admin\AppData\Local\Temp\528502657c770fd56ebd10c11c1a7fab24be2a41ad8f24af617222c069310263.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2944 -
C:\Windows\system32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:2136
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=unbounded2⤵
- Interacts with shadow copies
PID:2636
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2548
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2580
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2576
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2760
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1628
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2612
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2564
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2364
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1608
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1636
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:2028
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
PID:1500
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:1184
-
-
C:\Windows\system32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:1524
-
-
C:\Windows\system32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest2⤵
- Deletes System State backups
- Drops file in Windows directory
PID:1256
-
-
C:\Windows\System32\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2300
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\528502~1.EXE >> NUL2⤵
- Deletes itself
PID:2844
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2732
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
3File Deletion
3Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5893f01d2940485c52e402a2a75a2186b
SHA145861f33eec5e9c030687817b0e034d10d7f8d7e
SHA2560d558373ce997137b5f4a1d487bca959c20092ce9da8a44fc3b297a19a6d69bc
SHA512bc5545381380ba72b85d118817a0b200822f67e8c80325a5ed540f1254af511e5e21b723b2281e428ecdd3c380b7e4c1125eb8bfbadc1f11d38def6303510c62