medusalocker | 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334

Resubmissions

23/04/2026, 19:11

260423-xwbrkaf13110

07/10/2025, 12:59

251007-p8hfwaxjy810

02/10/2025, 12:48

251002-p14zxa1tew10

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20250610-en
resource tags

arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2025, 12:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
Size 236KB
Sample251002-p14zxa1tew
SHA256 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334
MD5 361c72e2042e5a0ede485b743e1708b2
SHA1 c0ce83bd865263fdf2cde83893cbdba92adc0491
SHA512 ca5ac851841caf0de56ec24c6ebff17b82b64d2ba5561cc079d4e1223cb3f32ffeeb8fe287d1541695c15c9ea97d9c7bf20f1f1a0b33b6b912d9a75f101b9f04
SSDEEP 6144:8THUyAFbF+0kV4R8dKH45l+tUmZ/6TeDR76ccYRkPTt:8Th0E0G4RaK6lkUmZyyD1cYiJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery medusalocker ransomware spyware stealer trojan

Malware Config

Extracted

Path

\Device\HarddiskVolume1\Boot\how_to_back_files.html

Ransom Note

<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; word-break: break-all; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">B6A2056635081339E1D25EB0FEFBC0636BD796B960CDA5A23729737F37A4A33DB7CFA3FE44A31BDA9938D868D6C93FF9FDBFC4D1830A35FBC60AD351BCD39D03<br>2CF911BA3AEC9900619CBF3AC07E6C097008225B0D82CEB27B6520F5C37567454879F60D898EE4EC8061DA8FC9C92C5F19BE56370D9CBC67F1381E10A429<br>350C8CA0EB1EF6E90B07DA03825B2458C148AA1D9311EF30574BA5552A4FC98E284432C149CC5081734FDF8880B0F33E65EBE0541D3B6F2A7E20D9CBA313<br>29010151342C483783E3EC5F860A28BA99E38D8696134A138CBBE2CB9DADE6DCE1AE9F7CA9052432E4180909673887B421C5DBD2A4C5BBD698CF2873E83C<br>64962B9D91320BE513D4D0ADBF27D6DD7A619574AAE264A4839E2A49106CD98F854C2DC017F113574433FC8CC085EC6A564326DABAB6CEC84D995B317DBC<br>0B2BE8985945F2FC450D5668DB164CE76D9326651A5132B4216B66AC2D35F91F9D1BE8E74A6BE7B9C6438692DE29F30B240E2996C89FEF05577384C18A21<br>E042A6C0DA047D3E80C7726C4AEBD4A684D224396D4F8D7C4DDF4FFE4A5C4057FDD1AA0722C964BECDAF62702F157ED2DEF1A824324DE42D5053045E29DF<br>8689300CFADA82DEC6132773FBFF7AD03CC859E6C1CCB75583D5F30C8260AA541418DF07795270440129A882B93800D8DDC7AEF55F07D7D5E5D459C2C4A2<br>D6F0CD60B06510BFBED6BA41F589</span> <br>  </div> </div>  <div class="tabs">  <div class="tab"> <div id="tab-content1" class="content"> <div class="text">  <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br>  <hr> <b>Contact us for price and get decryption software.</b><br><br> <a></a><br> <br><br> Follow the instructions to open the link:<br> <br> <br> <a><br> </a> 4. Start a chat and follow the further instructions. <br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div>   </div> </div>  </div> </div> </body> </html>

Emails

Signatures

MedusaLocker
Ransomware with several variants first seen in September 2019.
ransomware medusalocker

MedusaLocker payload 15 IoCs

resource	yara_rule
behavioral1/memory/5828-678-0x0000000000400000-0x00000000004B2000-memory.dmp	family_medusalocker
behavioral1/memory/5828-679-0x0000000000400000-0x00000000004B2000-memory.dmp	family_medusalocker
behavioral1/memory/5828-680-0x0000000000400000-0x00000000004B2000-memory.dmp	family_medusalocker
behavioral1/memory/5828-681-0x0000000000400000-0x00000000004B2000-memory.dmp	family_medusalocker
behavioral1/memory/5828-682-0x0000000000400000-0x00000000004B2000-memory.dmp	family_medusalocker
behavioral1/memory/5828-683-0x0000000000400000-0x00000000004B2000-memory.dmp	family_medusalocker
behavioral1/memory/1064-686-0x0000000000400000-0x00000000004B2000-memory.dmp	family_medusalocker
behavioral1/memory/5828-687-0x0000000000400000-0x00000000004B2000-memory.dmp	family_medusalocker
behavioral1/memory/5828-688-0x0000000000400000-0x00000000004B2000-memory.dmp	family_medusalocker
behavioral1/memory/5828-689-0x0000000000400000-0x00000000004B2000-memory.dmp	family_medusalocker
behavioral1/memory/5828-690-0x0000000000400000-0x00000000004B2000-memory.dmp	family_medusalocker
behavioral1/memory/5828-691-0x0000000000400000-0x00000000004B2000-memory.dmp	family_medusalocker
behavioral1/memory/5828-692-0x0000000000400000-0x00000000004B2000-memory.dmp	family_medusalocker
behavioral1/memory/5828-693-0x0000000000400000-0x00000000004B2000-memory.dmp	family_medusalocker
behavioral1/memory/5828-694-0x0000000000400000-0x00000000004B2000-memory.dmp	family_medusalocker

Medusalocker family
medusalocker

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe

Renames multiple (218) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 1 IoCs

pid	Process
1064	svhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	\??\Z:\$RECYCLE.BIN\S-1-5-21-3001560346-2020497773-4190896137-1000\desktop.ini	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\X:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\B:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\E:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\N:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\T:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\U:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\Y:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\Z:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\I:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\L:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\P:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\S:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\F:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\A:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\H:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\J:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\M:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\O:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\Q:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\G:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\K:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\R:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
File opened (read-only)	\??\V:	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe

Suspicious use of AdjustPrivilegeToken 63 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2608	wmic.exe
Token: SeSecurityPrivilege	2608	wmic.exe
Token: SeTakeOwnershipPrivilege	2608	wmic.exe
Token: SeLoadDriverPrivilege	2608	wmic.exe
Token: SeSystemProfilePrivilege	2608	wmic.exe
Token: SeSystemtimePrivilege	2608	wmic.exe
Token: SeProfSingleProcessPrivilege	2608	wmic.exe
Token: SeIncBasePriorityPrivilege	2608	wmic.exe
Token: SeCreatePagefilePrivilege	2608	wmic.exe
Token: SeBackupPrivilege	2608	wmic.exe
Token: SeRestorePrivilege	2608	wmic.exe
Token: SeShutdownPrivilege	2608	wmic.exe
Token: SeDebugPrivilege	2608	wmic.exe
Token: SeSystemEnvironmentPrivilege	2608	wmic.exe
Token: SeRemoteShutdownPrivilege	2608	wmic.exe
Token: SeUndockPrivilege	2608	wmic.exe
Token: SeManageVolumePrivilege	2608	wmic.exe
Token: 33	2608	wmic.exe
Token: 34	2608	wmic.exe
Token: 35	2608	wmic.exe
Token: 36	2608	wmic.exe
Token: SeIncreaseQuotaPrivilege	1664	wmic.exe
Token: SeSecurityPrivilege	1664	wmic.exe
Token: SeTakeOwnershipPrivilege	1664	wmic.exe
Token: SeLoadDriverPrivilege	1664	wmic.exe
Token: SeSystemProfilePrivilege	1664	wmic.exe
Token: SeSystemtimePrivilege	1664	wmic.exe
Token: SeProfSingleProcessPrivilege	1664	wmic.exe
Token: SeIncBasePriorityPrivilege	1664	wmic.exe
Token: SeCreatePagefilePrivilege	1664	wmic.exe
Token: SeBackupPrivilege	1664	wmic.exe
Token: SeRestorePrivilege	1664	wmic.exe
Token: SeShutdownPrivilege	1664	wmic.exe
Token: SeDebugPrivilege	1664	wmic.exe
Token: SeSystemEnvironmentPrivilege	1664	wmic.exe
Token: SeRemoteShutdownPrivilege	1664	wmic.exe
Token: SeUndockPrivilege	1664	wmic.exe
Token: SeManageVolumePrivilege	1664	wmic.exe
Token: 33	1664	wmic.exe
Token: 34	1664	wmic.exe
Token: 35	1664	wmic.exe
Token: 36	1664	wmic.exe
Token: SeIncreaseQuotaPrivilege	3104	wmic.exe
Token: SeSecurityPrivilege	3104	wmic.exe
Token: SeTakeOwnershipPrivilege	3104	wmic.exe
Token: SeLoadDriverPrivilege	3104	wmic.exe
Token: SeSystemProfilePrivilege	3104	wmic.exe
Token: SeSystemtimePrivilege	3104	wmic.exe
Token: SeProfSingleProcessPrivilege	3104	wmic.exe
Token: SeIncBasePriorityPrivilege	3104	wmic.exe
Token: SeCreatePagefilePrivilege	3104	wmic.exe
Token: SeBackupPrivilege	3104	wmic.exe
Token: SeRestorePrivilege	3104	wmic.exe
Token: SeShutdownPrivilege	3104	wmic.exe
Token: SeDebugPrivilege	3104	wmic.exe
Token: SeSystemEnvironmentPrivilege	3104	wmic.exe
Token: SeRemoteShutdownPrivilege	3104	wmic.exe
Token: SeUndockPrivilege	3104	wmic.exe
Token: SeManageVolumePrivilege	3104	wmic.exe
Token: 33	3104	wmic.exe
Token: 34	3104	wmic.exe
Token: 35	3104	wmic.exe
Token: 36	3104	wmic.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5828 wrote to memory of 2608	5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe	84
PID 5828 wrote to memory of 2608	5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe	84
PID 5828 wrote to memory of 2608	5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe	84
PID 5828 wrote to memory of 1664	5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe	87
PID 5828 wrote to memory of 1664	5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe	87
PID 5828 wrote to memory of 1664	5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe	87
PID 5828 wrote to memory of 3104	5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe	89
PID 5828 wrote to memory of 3104	5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe	89
PID 5828 wrote to memory of 3104	5828	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe	89

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe

C:\Users\Admin\AppData\Local\Temp\183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
"C:\Users\Admin\AppData\Local\Temp\183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5828
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic.exe SHADOWCOPY /nointeractive
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2608
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic.exe SHADOWCOPY /nointeractive
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1664
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic.exe SHADOWCOPY /nointeractive
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3104

C:\Users\Admin\AppData\Roaming\svhost.exe
C:\Users\Admin\AppData\Roaming\svhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svhost.exe

Path C:\Users\Admin\AppData\Roaming\svhost.exe
Size 236KB
SHA256 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334
MD5 361c72e2042e5a0ede485b743e1708b2
SHA1 c0ce83bd865263fdf2cde83893cbdba92adc0491
SHA512 ca5ac851841caf0de56ec24c6ebff17b82b64d2ba5561cc079d4e1223cb3f32ffeeb8fe287d1541695c15c9ea97d9c7bf20f1f1a0b33b6b912d9a75f101b9f04
SSDEEP 6144:8THUyAFbF+0kV4R8dKH45l+tUmZ/6TeDR76ccYRkPTt:8Th0E0G4RaK6lkUmZyyD1cYiJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntuser.dat.LOG2

Path C:\Users\Default\ntuser.dat.LOG2
Size 536B
SHA256 69f8d12d282049d2dbf88be8dbb3448e5ee24a871cde3feb68086c34c7ef43d0
MD5 2b9ade8cfe1e97e1355c9d755f8c12f3
SHA1 40fb59b428109774e2ff5a2b077971ec99c068da
SHA512 9d9ed1267ca2b542b58f5abf531be64c030891362807a7f75f612ce414e0e86b6d2503c11aef91b99335aee394610856c56867c23f8006febfe41392e2d34a00
MD5 SHA1 SHA512

Submit Download

how_to_back_files.html

Path \Device\HarddiskVolume1\Boot\how_to_back_files.html
Size 4KB
SHA256 91a9633066e790f3d3d72ec4f7ed13315e3520d5ed192af5ec9dfdad314ee6aa
MD5 6ed7e57d62368ec1eded21d9f47560c8
SHA1 e51addb3bb76fa0cbf3cfe7ce34839751607e9ce
SHA512 9855be45a41160801813be382b1f92881b33409d004f9abef21b1040f1d136541a1d313fdca1d8fd4147777c8d998ca045a395edf29a4ebd5cd0300e401cff59
SSDEEP 96:8y+cAl5azrn+DtZogbOydhiHQqk4iKFe8LTRjY:8OAl0zaDjrOyf2QR9KYQu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1064-686-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5828-683-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5828-687-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5828-681-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5828-682-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5828-0-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5828-679-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5828-678-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5828-680-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5828-688-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5828-689-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5828-690-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5828-691-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5828-692-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5828-693-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/5828-694-0x0000000000400000-0x00000000004B2000-memory.dmp

Download