Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-09-2024 10:24
Static task
static1
Behavioral task
behavioral1
Sample
1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe
Resource
win10v2004-20240802-en
General
-
Target
1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe
-
Size
1005KB
-
MD5
aee55fe409111fe0a9ab4953135190c4
-
SHA1
8076e1f1dfa958425739b6a7097ec65295cf7f98
-
SHA256
1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27
-
SHA512
240743bddd582dc9702478a77ce04688deefb22308150acda89e639ee0ee9b8feb7409bee4497204d2c8b649f3b67b2499817ce276b7e50d19fd71b1a3eb8102
-
SSDEEP
12288:wbWIqB/A1gv9XQ7ZNlZDV3LEWI+Xx+uBW6y4qNmh6:wbyxv9XQ7B3oWI+XHW6y4y
Malware Config
Extracted
C:\MSOCache\akira_readme.txt
akira
https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion
https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion
Signatures
-
Akira
Akira is a ransomware first seen in March 2023 and targets several industries, including education, finance, real estate, manufacturing, and consulting.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powershell.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1020 2916 powershell.exe -
Renames multiple (8613) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell command to delete shadowcopy.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 47 IoCs
Processes:
1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exedescription ioc process File opened for modification C:\Users\Public\Videos\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Public\Music\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\FP29B0EC\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Public\Documents\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\TN6BGAW3\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Admin\Links\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\VSUVY3HP\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Admin\Music\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\U9KKHJMH\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Public\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Drops file in Program Files directory 64 IoCs
Processes:
1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pitcairn 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\IPDSINTL.DLL 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-views.xml 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\6.png 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\Notebook03.onepkg 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File created C:\Program Files\Reference Assemblies\Microsoft\akira_readme.txt 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File created C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\akira_readme.txt 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGLINACC.XML 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_flyout.png 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\gfserrortogroove.ico 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File created C:\Program Files\Microsoft Games\Purble Place\en-US\akira_readme.txt 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_bottom.png 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\akira_readme.txt 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\akira_readme.txt 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\SUBMIT.JS 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FORM.ICO 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\akira_readme.txt 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02074_.GIF 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115836.GIF 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\akira_readme.txt 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_zh_CN.jar 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-threaddump.jar 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_ja_4.4.0.v20140623020002.jar 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Angles.xml 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLOOK_COL.HXT 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\COIN.WAV 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00391_.WMF 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0297185.WMF 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\akira_readme.txt 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\dnsns.jar 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\ant-javafx.jar 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Median.thmx 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs.xml 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\AFTRNOON.ELM 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107158.WMF 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\OLADDR.FAE 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\ShvlRes.dll.mui 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02262_.WMF 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\WARN.WAV 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\akira_readme.txt 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_hail.png 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00911_.WMF 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02055_.WMF 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02263_.WMF 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\akira_readme.txt 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCOUPON.DPV 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\settings.html 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_ja.jar 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\Internet Explorer\en-US\iedvtool.dll.mui 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099171.WMF 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239967.WMF 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository_2.3.0.v20131211-1531.jar 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21421_.GIF 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\vlc.mo 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\de-DE\Minesweeper.exe.mui 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonDown_Off.png 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0228823.WMF 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Amsterdam 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe File opened for modification C:\Program Files (x86)\Windows Media Player\de-DE\wmpnssui.dll.mui 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exepowershell.exepid process 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 1020 powershell.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe 2792 1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 1020 powershell.exe Token: SeBackupPrivilege 1676 vssvc.exe Token: SeRestorePrivilege 1676 vssvc.exe Token: SeAuditPrivilege 1676 vssvc.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe"C:\Users\Admin\AppData\Local\Temp\1fd9f2cdf2ee55d5d91e890c6a16e468f576a4e97747093204ffb122eacf2a27.bin.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Get-WmiObject Win32_Shadowcopy | Remove-WmiObject"1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\akira_readme.txtFilesize
2KB
MD5abc048f9ff193da0fdc92f7cb3360879
SHA13b48671887f01193431df9a915a2e21b6dd64942
SHA256408c258b426b5f1a887848f29ce711b353681580f8d3f40407046e0bc912d6aa
SHA512f43aa6b9ef45327db2e786f5edfce02d4520a22ae6a55bd7e971066e6f9618ec8d6586e72b4ca58bc8a6d9d3e705b66e7d85c518554f49ae2528951a463cafff
-
memory/1020-4-0x000007FEF5DCE000-0x000007FEF5DCF000-memory.dmpFilesize
4KB
-
memory/1020-6-0x00000000027F0000-0x00000000027F8000-memory.dmpFilesize
32KB
-
memory/1020-5-0x000000001B5E0000-0x000000001B8C2000-memory.dmpFilesize
2.9MB
-
memory/1020-7-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmpFilesize
9.6MB
-
memory/1020-8-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmpFilesize
9.6MB
-
memory/1020-9-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmpFilesize
9.6MB
-
memory/1020-10-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmpFilesize
9.6MB
-
memory/1020-11-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmpFilesize
9.6MB