Analysis
-
max time kernel
95s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04-09-2024 10:25
Static task
static1
Behavioral task
behavioral1
Sample
cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe
Resource
win10v2004-20240802-en
General
-
Target
cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe
-
Size
1005KB
-
MD5
0c30fdc297c54753166d572ed04d1d6b
-
SHA1
3a05c251c1050b505b15e57f60459506cdec3c72
-
SHA256
cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8
-
SHA512
880a70b5637e19ac2f67fcaac16680335e26aa2b41245670574944249d9100a110d66c311659285c04ab1b1db6f0d69369b3626621972cc4b149dcdc79ecc016
-
SSDEEP
12288:wbWIqB/A1gv9XQ7ZNlZDV3LEWI+Xx+uBW6y4qNmhY:wbyxv9XQ7B3oWI+XHW6y4g
Malware Config
Extracted
C:\Program Files\7-Zip\akira_readme.txt
akira
https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion
https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion
Signatures
-
Akira
Akira is a ransomware first seen in March 2023 and targets several industries, including education, finance, real estate, manufacturing, and consulting.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powershell.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5612 6008 powershell.exe -
Renames multiple (8451) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell command to delete shadowcopy.
-
Drops startup file 1 IoCs
Processes:
cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\akira_readme.txt cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 31 IoCs
Processes:
cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Users\Public\Desktop\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Users\Public\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Users\Public\Documents\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Users\Admin\Music\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Users\Admin\Searches\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Users\Public\Libraries\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files (x86)\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Users\Admin\Links\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Users\Admin\Videos\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Users\Public\Pictures\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Users\Admin\Documents\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Users\Public\Downloads\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Users\Public\Music\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Users\Public\Videos\desktop.ini cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe -
Drops file in Program Files directory 64 IoCs
Processes:
cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fr-ma\ui-strings.js cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\sr.pak cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File created C:\Program Files\VideoLAN\VLC\locale\uz\akira_readme.txt cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-16.png cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\fonts\akira_readme.txt cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-72.png cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File created C:\Program Files\Mozilla Firefox\fonts\akira_readme.txt cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-36_altform-lightunplated.png cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyShare-Dark.scale-150.png cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\PRNDMediaSource.winmd cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\VVIEWDWG.DLL cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedWideTile.scale-200_contrast-white.png cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\tab_mru_darktheme.png cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\combinepdf-tool-view.js cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-pl.xrm-ms cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XML2WORD.XSL cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-72_contrast-white.png cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\AppxManifest.xml cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\akira_readme.txt cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\avatar_128x.png cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-60.png cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeWideTile.scale-150.png cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\SmallTile.scale-100.png cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\akira_readme.txt cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ppd.xrm-ms cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\css\main-selector.css cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.scale-100_contrast-white.png cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\appuri.model cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-il\akira_readme.txt cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ar-ae\akira_readme.txt cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ddfa332af06cdcab2c9b9b51fadc27ac.arika cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\MSFT_PackageManagement.psm1 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderSplashScreen.contrast-black_scale-125.png cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\bn-BD\View3d\3DViewerProductDescription-universal.xml cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSmallTile.scale-125.png cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected] cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-si\akira_readme.txt cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MedTile.scale-125.png cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\subscription_intro\save-money.png cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-125_contrast-white.png cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-40_altform-lightunplated.png cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\help.svg cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fr-fr\ui-strings.js cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\msipc.dll.mui cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\akira_readme.txt cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSplashScreen.contrast-white_scale-100.png cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-20_altform-unplated.png cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailLargeTile.scale-100.png cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailMediumTile.scale-125.png cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\virgo_mycomputer_folder_icon.svg cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\APASixthEditionOfficeOnline.xsl cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\msmdsrvi_xl.rll cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\akira_readme.txt cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.UI\Resources\Images\star_empty.png cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-pl.xrm-ms cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exepowershell.exepid process 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 5612 powershell.exe 5612 powershell.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe 1056 cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 5612 powershell.exe Token: SeBackupPrivilege 3836 vssvc.exe Token: SeRestorePrivilege 3836 vssvc.exe Token: SeAuditPrivilege 3836 vssvc.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe"C:\Users\Admin\AppData\Local\Temp\cc970bd2673e46c7e0df5430ab617bc2a9214b4d5c2c44252af681a08ff526a8.bin.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Get-WmiObject Win32_Shadowcopy | Remove-WmiObject"1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\7-Zip\akira_readme.txtFilesize
2KB
MD595860a3684e436a515c86ba954e7e491
SHA18d61cff23d56fc922fedc978fc0293f34f6b13cf
SHA25665a5356f6bc47c81ed14441a08354f6a59e41d3e61965d5edb7c4f3fb8a5a1ae
SHA5125388bfb907208af091a2831411a7493e09866e5cf85699100476f151660192a48dc8e1fcc71937b23988f731020e72df912ce757ade42a1798c748d5e6277624
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5f38acb029258562b1aab55a45e880172
SHA1d4d41a4f29e9fde7b21b69c4fd1e72a0887cf783
SHA256183918b8548b09cd2d6d349ccddce0e17ee57ad574e40ec16b91448bde49307b
SHA5125936e4edd4eb9affdcd1165ff9a187f27918a5bc20b92cb6acaf8495472c98d3151f73b27e2ca99d323b51cdb64d18e3c592e657f9a4ffae971862bf63759b5e
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zmg5s53w.yxn.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/5612-0-0x00007FFA91C33000-0x00007FFA91C35000-memory.dmpFilesize
8KB
-
memory/5612-6-0x000001A7E4BB0000-0x000001A7E4BD2000-memory.dmpFilesize
136KB
-
memory/5612-11-0x00007FFA91C30000-0x00007FFA926F1000-memory.dmpFilesize
10.8MB
-
memory/5612-12-0x00007FFA91C30000-0x00007FFA926F1000-memory.dmpFilesize
10.8MB
-
memory/5612-15-0x00007FFA91C30000-0x00007FFA926F1000-memory.dmpFilesize
10.8MB