Overview
overview
10Static
static
10002.7z
windows10-2004-x64
301c647838c...7f.exe
windows10-2004-x64
1002f5c32fa2...d6.exe
windows10-2004-x64
61a05cba687...a3.exe
windows10-2004-x64
101a8f35d0f2...b9.exe
windows10-2004-x64
1af797776e...13.exe
windows10-2004-x64
101b2b369f31...2e.exe
windows10-2004-x64
31b4a0b685c...db.exe
windows10-2004-x64
31b4d73a9a7...89.exe
windows10-2004-x64
101ba8934b2e...4d.exe
windows10-2004-x64
31c2a51daa5...5b.exe
windows10-2004-x64
101c8bc3890f...45.exe
windows10-2004-x64
71ce9fa5304...ef.exe
windows10-2004-x64
1d51d46e07...cd.exe
windows10-2004-x64
101db9ec5678...e0.exe
windows10-2004-x64
101dbbed25cf...88.exe
windows10-2004-x64
1de8054e71...a1.exe
windows10-2004-x64
91e56efa724...ba.exe
windows10-2004-x64
31e754e1c7e...44.exe
windows10-2004-x64
31e8e39da21...bc.exe
windows10-2004-x64
1e9e575dd3...86.exe
windows10-2004-x64
31eb6de09f5...69.exe
windows10-2004-x64
41f0daca3fc...d9.exe
windows10-2004-x64
61f0efbc182...be.exe
windows10-2004-x64
1fd42d07b4...6e.exe
windows10-2004-x64
102a02608130...a1.exe
windows10-2004-x64
32a05ac3c43...e4.exe
windows10-2004-x64
102a32c84488...95.exe
windows10-2004-x64
102a6c920bfb...dc.exe
windows10-2004-x64
32aebddfd22...c8.exe
windows10-2004-x64
32b245f773b...bb.exe
windows10-2004-x64
102b331aa02a...b7.exe
windows10-2004-x64
10Resubmissions
15-10-2024 03:47
241015-ecgjlashrh 1005-08-2024 04:49
240805-ffygys1eke 1005-08-2024 03:50
240805-eee4jszepd 10Analysis
-
max time kernel
93s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-08-2024 04:49
Static task
static1
Behavioral task
behavioral1
Sample
002.7z
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
1e56efa7243a1d6456e47a8736751a3e338c837a1f1e27da3ca804544df41fba.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
1e754e1c7e081ae1e7701ba45c80ca4156d41d958158384a368047f3a6921044.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
1e8e39da21c7cf3c81528389a1e8bceac78993bfea33bfccbd0280953b5011bc.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
1e9e575dd30aa68e8cf8ff04cc591d429cdf1e09c3386e68d4cfb076dc997386.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
1eb6de09f5895458aefa5a1e603df84e403d54e00d5a07fa90a23dd850c7b069.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
1f0daca3fc222298b58d0a81333fb6875fbe1b7ab77c98d2c37c3e026a27b7d9.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
1f0efbc1828ca978f4db5d847ccae5044c27c8efa266a71289f0d824035d44be.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
2a02608130d8a74a6f641132c071bed4cf0bf0838dc0f53fcdf807fc851818a1.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
2a6c920bfb1259524d8e4e89c5408fd67c6fcfd2803b7a6c6dfbc9b86093a5dc.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
2aebddfd22ccb317b35b54e627d0eb05c59e761edbabe2a5029b19e8866e03c8.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
2b245f773b616b41fc7eb3026a5216e1b792a32ef2e833800e2f3b300b3498bb.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
2b331aa02af211be4b0491a173e17e09993f5d0a1900271b97b41daae740aeb7.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe
-
Size
205KB
-
MD5
5e9e6b90b530260d1f6dd462a9a2fa16
-
SHA1
3caa6e6d2aed85b9ea046a077a972c2a1718ee7b
-
SHA256
2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4
-
SHA512
2a0e6f2687e3bbb4158ce7bfc46b1c86794cb23fdbb041d0e5735b0e2674a9b27259edee3044e58202528e72e6c1b2ab6c4f7aeabb193f9d7f48b5bb60211f62
-
SSDEEP
6144:+B4Fr9NzqHW7V5V9w/UIRZizI1aqebq/lsyp:+B45qHW7nU/pZmiXqy
Malware Config
Signatures
-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware 2 IoCs
Processes:
resource yara_rule behavioral27/memory/928-1-0x0000000000550000-0x0000000000588000-memory.dmp family_chaos behavioral27/files/0x000c00000002336e-6.dat family_chaos -
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid Process 3756 bcdedit.exe 1440 bcdedit.exe -
Renames multiple (194) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
wbadmin.exepid Process 2360 wbadmin.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exesvchost.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation 2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation svchost.exe -
Drops startup file 3 IoCs
Processes:
svchost.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txt svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid Process 2684 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 34 IoCs
Processes:
svchost.exedescription ioc Process File opened for modification C:\Users\Admin\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini svchost.exe File opened for modification C:\Users\Public\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Searches\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini svchost.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vds.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid Process 4600 vssadmin.exe -
Modifies registry class 1 IoCs
Processes:
svchost.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings svchost.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid Process 700 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
svchost.exepid Process 2684 svchost.exe -
Suspicious behavior: EnumeratesProcesses 45 IoCs
Processes:
2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exesvchost.exepid Process 928 2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe 928 2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe 928 2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe 928 2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe 928 2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe 928 2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe 928 2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe 928 2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe 928 2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe 928 2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe 928 2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe 928 2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe 928 2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe 928 2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe 928 2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe 928 2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe 928 2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe 928 2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe 928 2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe 928 2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe 928 2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe 2684 svchost.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
Processes:
2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exesvchost.exevssvc.exeWMIC.exewbengine.exedescription pid Process Token: SeDebugPrivilege 928 2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe Token: SeDebugPrivilege 2684 svchost.exe Token: SeBackupPrivilege 4180 vssvc.exe Token: SeRestorePrivilege 4180 vssvc.exe Token: SeAuditPrivilege 4180 vssvc.exe Token: SeIncreaseQuotaPrivilege 1292 WMIC.exe Token: SeSecurityPrivilege 1292 WMIC.exe Token: SeTakeOwnershipPrivilege 1292 WMIC.exe Token: SeLoadDriverPrivilege 1292 WMIC.exe Token: SeSystemProfilePrivilege 1292 WMIC.exe Token: SeSystemtimePrivilege 1292 WMIC.exe Token: SeProfSingleProcessPrivilege 1292 WMIC.exe Token: SeIncBasePriorityPrivilege 1292 WMIC.exe Token: SeCreatePagefilePrivilege 1292 WMIC.exe Token: SeBackupPrivilege 1292 WMIC.exe Token: SeRestorePrivilege 1292 WMIC.exe Token: SeShutdownPrivilege 1292 WMIC.exe Token: SeDebugPrivilege 1292 WMIC.exe Token: SeSystemEnvironmentPrivilege 1292 WMIC.exe Token: SeRemoteShutdownPrivilege 1292 WMIC.exe Token: SeUndockPrivilege 1292 WMIC.exe Token: SeManageVolumePrivilege 1292 WMIC.exe Token: 33 1292 WMIC.exe Token: 34 1292 WMIC.exe Token: 35 1292 WMIC.exe Token: 36 1292 WMIC.exe Token: SeIncreaseQuotaPrivilege 1292 WMIC.exe Token: SeSecurityPrivilege 1292 WMIC.exe Token: SeTakeOwnershipPrivilege 1292 WMIC.exe Token: SeLoadDriverPrivilege 1292 WMIC.exe Token: SeSystemProfilePrivilege 1292 WMIC.exe Token: SeSystemtimePrivilege 1292 WMIC.exe Token: SeProfSingleProcessPrivilege 1292 WMIC.exe Token: SeIncBasePriorityPrivilege 1292 WMIC.exe Token: SeCreatePagefilePrivilege 1292 WMIC.exe Token: SeBackupPrivilege 1292 WMIC.exe Token: SeRestorePrivilege 1292 WMIC.exe Token: SeShutdownPrivilege 1292 WMIC.exe Token: SeDebugPrivilege 1292 WMIC.exe Token: SeSystemEnvironmentPrivilege 1292 WMIC.exe Token: SeRemoteShutdownPrivilege 1292 WMIC.exe Token: SeUndockPrivilege 1292 WMIC.exe Token: SeManageVolumePrivilege 1292 WMIC.exe Token: 33 1292 WMIC.exe Token: 34 1292 WMIC.exe Token: 35 1292 WMIC.exe Token: 36 1292 WMIC.exe Token: SeBackupPrivilege 376 wbengine.exe Token: SeRestorePrivilege 376 wbengine.exe Token: SeSecurityPrivilege 376 wbengine.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exesvchost.execmd.execmd.execmd.exedescription pid Process procid_target PID 928 wrote to memory of 2684 928 2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe 84 PID 928 wrote to memory of 2684 928 2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe 84 PID 2684 wrote to memory of 3284 2684 svchost.exe 86 PID 2684 wrote to memory of 3284 2684 svchost.exe 86 PID 3284 wrote to memory of 4600 3284 cmd.exe 88 PID 3284 wrote to memory of 4600 3284 cmd.exe 88 PID 3284 wrote to memory of 1292 3284 cmd.exe 91 PID 3284 wrote to memory of 1292 3284 cmd.exe 91 PID 2684 wrote to memory of 468 2684 svchost.exe 93 PID 2684 wrote to memory of 468 2684 svchost.exe 93 PID 468 wrote to memory of 3756 468 cmd.exe 95 PID 468 wrote to memory of 3756 468 cmd.exe 95 PID 468 wrote to memory of 1440 468 cmd.exe 96 PID 468 wrote to memory of 1440 468 cmd.exe 96 PID 2684 wrote to memory of 3952 2684 svchost.exe 97 PID 2684 wrote to memory of 3952 2684 svchost.exe 97 PID 3952 wrote to memory of 2360 3952 cmd.exe 99 PID 3952 wrote to memory of 2360 3952 cmd.exe 99 PID 2684 wrote to memory of 700 2684 svchost.exe 103 PID 2684 wrote to memory of 700 2684 svchost.exe 103 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe"C:\Users\Admin\AppData\Local\Temp\2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete3⤵
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:4600
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1292
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no3⤵
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:3756
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:1440
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet3⤵
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
PID:2360
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt3⤵
- Opens file in notepad (likely ransom note)
PID:700
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4180
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:376
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:3700
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:1704
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
205KB
MD55e9e6b90b530260d1f6dd462a9a2fa16
SHA13caa6e6d2aed85b9ea046a077a972c2a1718ee7b
SHA2562a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4
SHA5122a0e6f2687e3bbb4158ce7bfc46b1c86794cb23fdbb041d0e5735b0e2674a9b27259edee3044e58202528e72e6c1b2ab6c4f7aeabb193f9d7f48b5bb60211f62
-
Filesize
844B
MD5a23e76ce33adf72409fb0c43393d3087
SHA1502620245be1d0912ab9c4fb5390ab14e27778a8
SHA25688702c38b8bea9555a13ae747cbfdf2947fff6060f4fef75486025e0152ddf3a
SHA51224fdd6761b29eb62ecfefa7a5ed15705645c3a303ada3728823382ba38e08eae12f15840fb65361391cff1ba4cad55fdfb6e0144c9e95b7e7fbe928319d732bb