Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12-11-2024 16:35
Static task
static1
Behavioral task
behavioral1
Sample
78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe
Resource
win10v2004-20241007-en
General
-
Target
78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe
-
Size
1.0MB
-
MD5
436c014614477e79696e838d6b605f4e
-
SHA1
8951e54fabdd4d8e424573e53a51e309203f6f41
-
SHA256
78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0
-
SHA512
f3952b167c9177aafc302daea98cc6f48f27d7df3efdef3ed4c27603a375a9547d46f465900d9abb6f2e618cd50f4d0f295a4d2920b37f54130037073efc77b4
-
SSDEEP
12288:Vpp+QIEmDzuImC01vbUE98pik+2i1NkshdMMK+AX99etq2dTdJf:Vpp+Q+u5bUI8pij1NkshdMf99etb5P
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\akira_readme.txt
akira
https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion
https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion
Signatures
-
Akira
Akira is a ransomware first seen in March 2023 and targets several industries, including education, finance, real estate, manufacturing, and consulting.
-
Akira family
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powershell.exedescription pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2336 1376 powershell.exe 30 -
Renames multiple (8627) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell command to delete shadowcopy.
-
Drops startup file 1 IoCs
Processes:
78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\akira_readme.txt 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 47 IoCs
Processes:
78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exedescription ioc Process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Admin\Links\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\U3EGUGI8\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\QMPQWRBT\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Public\Documents\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Public\Music\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\39RANI6K\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Public\Videos\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AQYH36ZT\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Admin\Music\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Public\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Drops file in Program Files directory 64 IoCs
Processes:
78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exedescription ioc Process File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\DumontDUrville 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File created C:\Program Files\Microsoft Games\Hearts\akira_readme.txt 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15136_.GIF 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File created C:\Program Files (x86)\Windows Mail\de-DE\akira_readme.txt 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\flyout.html 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-gibbous_partly-cloudy.png 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSAEXP30.DLL 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EquityResume.Dotx 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.logging_1.1.1.v201101211721.jar 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341499.JPG 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00200_.WMF 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\picturePuzzle.js 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SWEST_01.MID 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_snow.png 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\1d541503ddcca7dddf60d0e8b17b82ce.arika 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0300520.GIF 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14693_.GIF 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00543_.WMF 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-javahelp.xml 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File created C:\Program Files\Microsoft Games\Minesweeper\es-ES\akira_readme.txt 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Windows Defender\fr-FR\MsMpRes.dll.mui 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00629_.WMF 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\40.png 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsPreviewTemplate.html 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File created C:\Program Files (x86)\Microsoft Office\Office14\0928c463e5e5624fbd3d9f0b23d52add.arika 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng.hyp 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107492.WMF 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_ja.jar 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01356_.WMF 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OFFXML.DLL 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kathmandu 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE05710_.WMF 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\akira_readme.txt 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower.png 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FSTOCK.DLL 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santo_Domingo 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_flyout.png 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_zh_CN.jar 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\akira_readme.txt 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\security\trusted.libraries 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Jerusalem 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\travel.png 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\akira_readme.txt 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kiritimati 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.xml 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\vlc.mo 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_left_pressed.png 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NL7Models0011.DLL 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SEQCHK10.DLL 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_zh_CN.jar 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File created C:\Program Files\VideoLAN\VLC\plugins\d3d9\akira_readme.txt 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL027.XML 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR14F.GIF 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_VelvetRose.gif 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLPH.DLL 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Havana 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Microsoft Games\Chess\it-IT\Chess.exe.mui 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00942_.WMF 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\3.png 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe File opened for modification C:\Program Files\Windows Mail\en-US\WinMail.exe.mui 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exepowershell.exepid Process 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2336 powershell.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe 2548 78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exevssvc.exedescription pid Process Token: SeDebugPrivilege 2336 powershell.exe Token: SeBackupPrivilege 1976 vssvc.exe Token: SeRestorePrivilege 1976 vssvc.exe Token: SeAuditPrivilege 1976 vssvc.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe"C:\Users\Admin\AppData\Local\Temp\78d75669390e4177597faf9271ce3ad3a16a3652e145913dbfa9a5951972fcb0.bin.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2548
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Get-WmiObject Win32_Shadowcopy | Remove-WmiObject"1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2336
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1976
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5b9ade8e7c1a5686f02f97e167f5f149a
SHA1e0c4ad589181d29538b017b814f0a44021415407
SHA256dd307903ace2ccc3b6c640a20e0ab28e0c943e316b58a3570bf006b5cbb35757
SHA5126998b42c8b12bfde05e997c6f0c79d6c10638794f2bd1833f502c91f85d319bc35182254d23a72e330babd355e9c95ae0227c5faab7a2f6a859d6160fd4aefd9