akira | bb80103ac259b0a260fe3fabea6c6ceedf4286f43b24665a9ec30bc1b19bd267

Analysis

max time kernel
32s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 05:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Files/0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
Size

1.0MB
MD5

d37594e06b180d71d1612e6fd61e02a2
SHA1

d9d8836f5ed53513401b379d5806501d5b1e000a
SHA256

0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005
SHA512

a2f4bbe84a0d78897604eaf10c18581c0676f23a15e7ab8b95b80d1f84898a49a4132aecb194631d2df4f0c5616d4d2c85959af27fbbfb65f257773b6ebbde29
SSDEEP

12288:nLXeXuANMx17cMW50NY3RuKI5B/N++PP8fACq6EBvxz:LXcuA4cMW50kuKI5B/pP8fACHE

Score

10^/10

akira execution ransomware ransowmware spyware stealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\akira_readme.txt

Family

akira

Ransom Note

Hi friends, Whatever who you are and what your title is if you're reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption. Well, for now let's keep all the tears and resentment to ourselves and try to build a constructive dialogue. We're fully aware of what damage we caused by locking your internal sources. At the moment, you have to know: 1. Dealing with us you will save A LOT due to we are not interested in ruining your financially. We will study in depth your finance, bank & income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of a deal. 2. Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. If you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidently corrupt them - in this case we won't be able to help. 3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data. 4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion. 5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us. If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions: 1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/. 2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/1322809546-JOKLE 3. Use this code - 6980-GX-MHHO-DGZR - to log into our chat. Keep in mind that the faster you will get in touch, the less damage we cause.

URLs

https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion

https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/1322809546-JOKLE

Signatures

Akira
Akira is a ransomware first seen in March 2023 and targets several industries, including education, finance, real estate, manufacturing, and consulting.
ransomware akira
Akira family
akira

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	2352	powershell.exe	30

Renames multiple (8643) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell command to delete shadowcopy.

execution ransowmware

PowerShell

T1059.001

pid	Process
1728	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\akira_readme.txt	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 47 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\HUSZWRNT\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\OIPA882W\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\TUVLNS83\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Public\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\F17E26FP\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\System\msadc\fr-FR\akira_readme.txt	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02264_.WMF	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Details.accdt	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00074_.WMF	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\akira_readme.txt	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\akira_readme.txt	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152892.WMF	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0215718.WMF	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGTOC.XML	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\add_up.png	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ta.pak	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cancun	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.registry_3.5.400.v20140428-1507.jar	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00941_.WMF	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\UTC	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\RESUME.DPV	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.WPG	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105710.WMF	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.configuration_5.5.0.165303.jar	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_zh_4.4.0.v20140623020002.jar	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_zh_CN.jar	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PSRCHLTS.DAT	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\Mozilla Firefox\update-settings.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\it-IT\msadcer.dll.mui	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Porto_Velho	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01770_.GIF	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_zh_CN.jar	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18197_.WMF	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\OMSMMS.CFG	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107152.WMF	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0200151.WMF	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309705.JPG	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\OFFICE10.DLL	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\pref\autoconfig.js	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ie\LC_MESSAGES\akira_readme.txt	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\vlc.mo	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.STD	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00560_.WMF	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-windows.xml	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Tucuman	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Boa_Vista	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\excel.exe.manifest	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\akira_readme.txt	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fakaofo	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285782.WMF	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02071U.BMP	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15301_.GIF	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\REPORTL.ICO	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SHARING.CFG	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\MSB1CACH.LEX	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\VERSION.txt	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+6	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SIGNL.ICO	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sl\akira_readme.txt	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
1728	powershell.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
2520	0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1728	powershell.exe
Token: SeBackupPrivilege	2704	vssvc.exe
Token: SeRestorePrivilege	2704	vssvc.exe
Token: SeAuditPrivilege	2704	vssvc.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Files\0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe
"C:\Users\Admin\AppData\Local\Temp\Files\0fe572e7aad25a38ba9ee9b4600ddc02641e29061de250c525d6828f70326005.exe"
1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2520

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -Command "Get-WmiObject Win32_Shadowcopy | Remove-WmiObject"
1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1728

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\akira_readme.txt

Filesize
2KB

MD5
a561d1700a57e4963efaabfcc181db8e

SHA1
087d67f93165893562cafbe17708f0a6b10b9ea3

SHA256
f03b00913b35c006a8709060c9be4b8e28946abecc0bb14df0e2df4bc2c45a94

SHA512
75f2d29c2f86219b722761122c4dcd59db23893e6a0449eec22e62d5cfa8eb62d0099c4ff8b74bad26028d72643f8477af619740ffd0c03ee9f592464ccbdc45

Download Submit
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt.akira

Filesize
28KB

MD5
861a7d85082dc47430621eb0b7dae8f8

SHA1
7eba648fb26ea77216ce8646b4a35d7f95ab49e2

SHA256
926685cda4e2d73b7c2b42cd8f60ccdabc12fb9d3eeb572a7264720038dce574

SHA512
a4a490b30db50ea509295a2e6f10979ef418908264dde2cc059e803492ad4123af0a5de74c39436a9662e739996d76c31b0104182c5040cf14dcdb9b6186cea6

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html.akira

Filesize
12KB

MD5
07082d2d9024007fe0a21139db608b1e

SHA1
4600768978928469f111d633f978fb494f7d8061

SHA256
2bf2386612f9e9a384aa0a26a2b6678566b29595eced451d01d2213549141e92

SHA512
9333e6cb1c3f5a8a3700d1bdfa55fe87078be2597611bffb5386812f2f30b37f7703a9dafe054bc5b60903f280a753ed34b3103389d595617fbf2b43f453ff47

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html.akira

Filesize
9KB

MD5
0eb4b5416b039c825ca9fc4750f6c02b

SHA1
1f941b72f875ed652b432d963d3feafa9535aded

SHA256
1556b8c9a08f0f5224997a933b722b6ac71667e1c5cfad10451f569dbe3409c4

SHA512
b62cc5abe90555ac972836ad55a853725c449001e25f4bc2c2e4293c681352e51aded2007beedbf35fbda1a823a0fc59b1680bb58714955e0d2c778f4feb765b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA.akira

Filesize
8KB

MD5
51bdb84ecbc55cf6afeab452c9aa0dc3

SHA1
7e2fde0082ca3ab1e4487b932ff39dfb84cef316

SHA256
eb1f1d26ca89990c87b066f42ee20a9e299f4c7cd0df9e6d626e18aed5c1a126

SHA512
99eb5f2d647bbd43d951ff417f82df40331426b9ba8381ae749d915a1c608a1ec6f167786d787baf2385ba5079e57442889c2996c08a82bf55a3e7ac1c7a7ad7

Download Submit
C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\vlc.mo.akira

Filesize
831KB

MD5
5476b197a3ff3b98311329ee6ddac040

SHA1
8976a6225b6fe1cf03e134ec6159dc77f1447e83

SHA256
ae4d76535e18fe0d08402f78713cf5e17f21463b8fd7e66325f73d121a8f38ce

SHA512
5dd46c1afc395fbc5c71e71abf6fcca3121f64b5ebba45263c83da0e3323585dd932ca4b12fefd1e066391f18cb5a174a911c897bf12bc97bb8e15e7340a0d13

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_2.akira

Filesize
8KB

MD5
0adaadd9be284788220f27da22aa28ff

SHA1
d87a40814e4c81bebd2b269d7ca846467f7324f6

SHA256
77bb065acc6af322b2c5264b7cfc859a20b1ae63883a306478006a605e30adbd

SHA512
e992c9f1c9456db7aba713cd83663e4b67672ea3727e3a05ce031e222d1e083688b469e7159379fa884ae893b433dfe6cd5925e2fa88956cfee0dde37a2a927c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Web Slice Gallery~.feed-ms.akira

Filesize
28KB

MD5
2b5ed82c0e6d25dd42f2d0d15c63865f

SHA1
b31ceabccbb071769f52d6508ed870d8df8e9d1d

SHA256
a8b78f75458120c9593204013c40214b4ab24a5a36dcecee36973646175cbce7

SHA512
11e03c072a0dc590b3350c056174abfa1cb2a053f6d7c02847e5d5db9ba03bc8150167c70f6ee8787a1ccfa287efb8d14e9d7a71bed940be2034490bce405e01

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bs4a8d8y.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.akira

Filesize
48KB

MD5
e2218d48676340d994539c3017ca8dc3

SHA1
d402e8a24caa5fb37e05410eee4216475519a43c

SHA256
2e725596067dea5b1a82c10a10341dc02677888be89e557edaead168b540f381

SHA512
2754ae2a6babf2ba26a51411ac18358620847a0536ea664b2a149ea7041f7b4752c67552c37e18d09e9efe9f6d0c5cc99d44b09e794f6f39a973d042e2782b65

Download Submit
memory/1728-8-0x000007FEF4E10000-0x000007FEF57AD000-memory.dmp

Filesize
9.6MB

Download
memory/1728-7-0x000007FEF4E10000-0x000007FEF57AD000-memory.dmp

Filesize
9.6MB

Download
memory/1728-6-0x00000000021D0000-0x00000000021D8000-memory.dmp

Filesize
32KB

Download
memory/1728-5-0x000000001B7E0000-0x000000001BAC2000-memory.dmp

Filesize
2.9MB

Download
memory/1728-4-0x000007FEF50CE000-0x000007FEF50CF000-memory.dmp

Filesize
4KB

Download