Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06-11-2024 03:22
Static task
static1
Behavioral task
behavioral1
Sample
aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe
Resource
win10v2004-20241007-en
General
-
Target
aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe
-
Size
1.0MB
-
MD5
feb81a8d7e0f91d6f74b440cdd3c2f28
-
SHA1
8c479629f45d8d9ea5e6ed48a3eeb9917fb7ad07
-
SHA256
aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9
-
SHA512
bf83affcd1ea656e05f18e55eb23cce2e2cb33ca6f24f5c22374c6f1d41f6277794c21f926939028326c043798bf34f14194b3ad51cee763b053e7a519199623
-
SSDEEP
12288:Vpp+QIEmDzuImC01vbUE98pik+2i1NkshdMMK+AX99etq2dTd7f:Vpp+Q+u5bUI8pij1NkshdMf99etb5R
Malware Config
Extracted
C:\Program Files\7-Zip\akira_readme.txt
akira
https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion
https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/3175904882-XTBIJ
Signatures
-
Akira
Akira is a ransomware first seen in March 2023 and targets several industries, including education, finance, real estate, manufacturing, and consulting.
-
Akira family
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powershell.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4596 1500 powershell.exe -
Renames multiple (8371) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell command to delete shadowcopy.
-
Drops startup file 1 IoCs
Processes:
aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\akira_readme.txt aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 31 IoCs
Processes:
aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exedescription ioc process File opened for modification C:\Program Files\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Users\Public\Documents\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Users\Admin\Documents\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Users\Public\Music\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Users\Public\Downloads\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Users\Public\Libraries\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Users\Public\Pictures\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Users\Admin\Links\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Users\Admin\Searches\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Users\Public\Desktop\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files (x86)\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Users\Admin\Music\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Users\Public\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Users\Admin\Videos\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Users\Public\Videos\desktop.ini aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe -
Drops file in Program Files directory 64 IoCs
Processes:
aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fr-CA\View3d\akira_readme.txt aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorSplashScreen.contrast-black_scale-100.png aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\ui-strings.js aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\virgo_mycomputer_folder_icon.svg aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\TabTip32.exe.mui aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\PLANNERS.ONE aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\6a9cf9e066bc4c0d99a76bf63ab54ffd.arika aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-60.png aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-150.png aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-256_altform-unplated.png aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256_altform-lightunplated.png aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File created C:\Program Files\Common Files\microsoft shared\ink\hr-HR\akira_readme.txt aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Media Renderer\RenderingControl_DMP.xml aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\akira_readme.txt aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\AppxMetadata\akira_readme.txt aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-80.png aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-36.png aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\temporary_multiselect_24.png aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-cn\akira_readme.txt aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\PREVIEW.GIF aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MINSBPROXY.DLL aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubMedTile.scale-125.png aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-tw\akira_readme.txt aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\PREVIEW.GIF aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\VBEUIRES.DLL aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\akira_readme.txt aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pt-br\akira_readme.txt aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sk-sk\akira_readme.txt aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\offsymsb.ttf aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\CHIMES.WAV aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Ear.png aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-16_altform-unplated_contrast-black.png aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-125_contrast-white.png aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-96_altform-unplated.png aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\akira_readme.txt aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\Common Files\System\ado\adojavas.inc aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ar-ae\akira_readme.txt aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\AppxManifest.xml aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner_int_2x.gif aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\ui-strings.js aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\akira_readme.txt aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-400.png aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageMedTile.scale-400.png aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\eu-es\ui-strings.js aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\akira_readme.txt aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-16_altform-lightunplated.png aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\export.svg aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pt-br\akira_readme.txt aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\as90.xsl aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymsb.ttf aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ro-ro\akira_readme.txt aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\en-GB.mail.config aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\MSFT_PackageManagementSource.schema.mfl aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql90.xsl aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exepowershell.exepid process 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4596 powershell.exe 4596 powershell.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe 4040 aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exevssvc.exedescription pid process Token: SeDebugPrivilege 4596 powershell.exe Token: SeBackupPrivilege 2268 vssvc.exe Token: SeRestorePrivilege 2268 vssvc.exe Token: SeAuditPrivilege 2268 vssvc.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe"C:\Users\Admin\AppData\Local\Temp\aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:4040
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Get-WmiObject Win32_Shadowcopy | Remove-WmiObject"1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4596
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2268
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD508f762538499795b3fabc40857f2caea
SHA1e9bf41d36e249f29877fe7f5211e3b3197edb5d4
SHA2566dd6401da86a4fa1e8b74802fa9417b573dec2c29beaa8827494702f07024c4b
SHA512e0466a5c878361ed2a3caff2a0df1f22a7772760bc81546a59f9a0e3e7402db4d67a82ceabb378857eea143d9834d6eb7284bbe10027322f648229981ab47b2a
-
Filesize
3KB
MD551e88d9e504d378feab8127cdbc7d2e6
SHA19a1968860eed81bec30b91c7e2236859186edaa6
SHA2562a69d098b6a4e7339f225abb746a534a8116c2c30ccfa222cbb990143c34d514
SHA512e0dd9947139ee4ecde71a407343ab1cbc53a4a02d32b86e501c253b051bee9c5c1884f38c0cb1530b9efcfa62263c093b07247fdefedadb44132249579c9eddb
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82