Resubmissions
23/04/2026, 19:11
260423-xwbrkaf1311007/10/2025, 12:59
251007-p8hfwaxjy81002/10/2025, 12:48
251002-p14zxa1tew10Analysis
- max time kernel
150s - max time network
102s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system - submitted
02/10/2025, 12:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
Resource
win10v2004-20250610-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
Resource
win11-20250619-en
windows11-21h2-x64
16 signatures
150 seconds
General
- Target 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
- Size 236KB
- Sample251002-p14zxa1tew
- SHA256 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334
- MD5 361c72e2042e5a0ede485b743e1708b2
- SHA1 c0ce83bd865263fdf2cde83893cbdba92adc0491
- SHA512 ca5ac851841caf0de56ec24c6ebff17b82b64d2ba5561cc079d4e1223cb3f32ffeeb8fe287d1541695c15c9ea97d9c7bf20f1f1a0b33b6b912d9a75f101b9f04
- SSDEEP 6144:8THUyAFbF+0kV4R8dKH45l+tUmZ/6TeDR76ccYRkPTt:8Th0E0G4RaK6lkUmZyyD1cYiJ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Path
-
\Device\HarddiskVolume1\Boot\how_to_back_files.html
Ransom Note
- <html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; word-break: break-all; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">56C5521104C08063038E8CD47D29DD6539BEABDB26CC900916D2971BFA7C64B5F25E0C2F7BC2379D55CC72BD260B94CE34E093DC793A6406C6BD4ADE768790E2<br>E168926C4CBADC3E767356482953C88D5BC6A43B2564758F067FCD85709F18DE8FACD53A186C8E46551B74CBD850CF25520861F57D5F28F426CDEA6D60E2<br>525A19F3DB824E28B32627B87DADEF692CEBED1409A170EDC130341C974A68EC39E6721D7B5D53F4BD152B589050CC09121FE3195FCD3ACB1582EF666285<br>F05C259488EB45950ED000AD248C3DA1C96406CF1F1C2425724F2F026CC9CC13BB4AF0AE43B47210A374DC3F28F72CC86C11924BB62ADB95C2D9AF5887C5<br>0CC345DF440838700ACA42D8BB97FF7F0FF16D56E6BEF37CB74C2687A068761C1D39F860143C75D1DCB6B91354C57FC9993439768DD5390566B54593B050<br>DE8799C9AB3901056D2D4A89F8206EB784173464730154DCBAB46D4D856A071BA73555A33A6210A08D3A4D40B2A095584F98EDEF65F77F71BDD002F9242A<br>212E24419E3FF5B2AC0BBC60A2BA677F466EE7934977B920A597C35D47ABA2257FA56AE75D33D63C955E7CDBAE4D42841876A2AEC2D177378A7A219F6B6D<br>DCDFB1BE03D00D7A82AC7D7313734D1EDCB60CF2E8B2CD1D7C719C06F6A58F4D8D53C5F9463DCEB1D366E890C3EBE5F07D51AF468C7160DBC785338852B5<br>62D70363B1C27C4EE66C49DACE5A</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a></a><br> <br><br> Follow the instructions to open the link:<br> <br> <br> <a><br> </a> 4. Start a chat and follow the further instructions. <br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected] ">[email protected] </a> <br> <a href="[email protected] ">[email protected] </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>
Emails
-
href="[email protected]
-
href="[email protected]
Signatures
- MedusaLocker
Ransomware with several variants first seen in September 2019.
- MedusaLocker payload 10 IoCs
resource yara_rule behavioral2/memory/5304-637-0x0000000000400000-0x00000000004B2000-memory.dmp family_medusalocker behavioral2/memory/5304-636-0x0000000000400000-0x00000000004B2000-memory.dmp family_medusalocker behavioral2/memory/5304-638-0x0000000000400000-0x00000000004B2000-memory.dmp family_medusalocker behavioral2/memory/5304-640-0x0000000000400000-0x00000000004B2000-memory.dmp family_medusalocker behavioral2/memory/5304-641-0x0000000000400000-0x00000000004B2000-memory.dmp family_medusalocker behavioral2/memory/5016-645-0x0000000000400000-0x00000000004B2000-memory.dmp family_medusalocker behavioral2/memory/5304-646-0x0000000000400000-0x00000000004B2000-memory.dmp family_medusalocker behavioral2/memory/5304-650-0x0000000000400000-0x00000000004B2000-memory.dmp family_medusalocker behavioral2/memory/5304-651-0x0000000000400000-0x00000000004B2000-memory.dmp family_medusalocker behavioral2/memory/5304-652-0x0000000000400000-0x00000000004B2000-memory.dmp family_medusalocker - Medusalocker family
- UAC bypass 3 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe - Renames multiple (204) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 1 IoCs
pid Process 5016 svhost.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-3625340254-1625357543-1797847221-1000\desktop.ini 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe File opened (read-only) \??\H: 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe File opened (read-only) \??\I: 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe File opened (read-only) \??\J: 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe File opened (read-only) \??\L: 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe File opened (read-only) \??\S: 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe File opened (read-only) \??\V: 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe File opened (read-only) \??\X: 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe File opened (read-only) \??\N: 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe File opened (read-only) \??\P: 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe File opened (read-only) \??\Z: 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe File opened (read-only) \??\F: 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe File opened (read-only) \??\B: 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe File opened (read-only) \??\Q: 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe File opened (read-only) \??\T: 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe File opened (read-only) \??\Y: 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe File opened (read-only) \??\A: 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe File opened (read-only) \??\E: 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe File opened (read-only) \??\K: 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe File opened (read-only) \??\M: 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe File opened (read-only) \??\O: 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe File opened (read-only) \??\R: 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe File opened (read-only) \??\U: 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe File opened (read-only) \??\W: 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe - Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5132 wmic.exe Token: SeSecurityPrivilege 5132 wmic.exe Token: SeTakeOwnershipPrivilege 5132 wmic.exe Token: SeLoadDriverPrivilege 5132 wmic.exe Token: SeSystemProfilePrivilege 5132 wmic.exe Token: SeSystemtimePrivilege 5132 wmic.exe Token: SeProfSingleProcessPrivilege 5132 wmic.exe Token: SeIncBasePriorityPrivilege 5132 wmic.exe Token: SeCreatePagefilePrivilege 5132 wmic.exe Token: SeBackupPrivilege 5132 wmic.exe Token: SeRestorePrivilege 5132 wmic.exe Token: SeShutdownPrivilege 5132 wmic.exe Token: SeDebugPrivilege 5132 wmic.exe Token: SeSystemEnvironmentPrivilege 5132 wmic.exe Token: SeRemoteShutdownPrivilege 5132 wmic.exe Token: SeUndockPrivilege 5132 wmic.exe Token: SeManageVolumePrivilege 5132 wmic.exe Token: 33 5132 wmic.exe Token: 34 5132 wmic.exe Token: 35 5132 wmic.exe Token: 36 5132 wmic.exe Token: SeIncreaseQuotaPrivilege 2664 wmic.exe Token: SeSecurityPrivilege 2664 wmic.exe Token: SeTakeOwnershipPrivilege 2664 wmic.exe Token: SeLoadDriverPrivilege 2664 wmic.exe Token: SeSystemProfilePrivilege 2664 wmic.exe Token: SeSystemtimePrivilege 2664 wmic.exe Token: SeProfSingleProcessPrivilege 2664 wmic.exe Token: SeIncBasePriorityPrivilege 2664 wmic.exe Token: SeCreatePagefilePrivilege 2664 wmic.exe Token: SeBackupPrivilege 2664 wmic.exe Token: SeRestorePrivilege 2664 wmic.exe Token: SeShutdownPrivilege 2664 wmic.exe Token: SeDebugPrivilege 2664 wmic.exe Token: SeSystemEnvironmentPrivilege 2664 wmic.exe Token: SeRemoteShutdownPrivilege 2664 wmic.exe Token: SeUndockPrivilege 2664 wmic.exe Token: SeManageVolumePrivilege 2664 wmic.exe Token: 33 2664 wmic.exe Token: 34 2664 wmic.exe Token: 35 2664 wmic.exe Token: 36 2664 wmic.exe Token: SeIncreaseQuotaPrivilege 1228 wmic.exe Token: SeSecurityPrivilege 1228 wmic.exe Token: SeTakeOwnershipPrivilege 1228 wmic.exe Token: SeLoadDriverPrivilege 1228 wmic.exe Token: SeSystemProfilePrivilege 1228 wmic.exe Token: SeSystemtimePrivilege 1228 wmic.exe Token: SeProfSingleProcessPrivilege 1228 wmic.exe Token: SeIncBasePriorityPrivilege 1228 wmic.exe Token: SeCreatePagefilePrivilege 1228 wmic.exe Token: SeBackupPrivilege 1228 wmic.exe Token: SeRestorePrivilege 1228 wmic.exe Token: SeShutdownPrivilege 1228 wmic.exe Token: SeDebugPrivilege 1228 wmic.exe Token: SeSystemEnvironmentPrivilege 1228 wmic.exe Token: SeRemoteShutdownPrivilege 1228 wmic.exe Token: SeUndockPrivilege 1228 wmic.exe Token: SeManageVolumePrivilege 1228 wmic.exe Token: 33 1228 wmic.exe Token: 34 1228 wmic.exe Token: 35 1228 wmic.exe Token: 36 1228 wmic.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5304 wrote to memory of 5132 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 80 PID 5304 wrote to memory of 5132 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 80 PID 5304 wrote to memory of 5132 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 80 PID 5304 wrote to memory of 2664 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 82 PID 5304 wrote to memory of 2664 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 82 PID 5304 wrote to memory of 2664 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 82 PID 5304 wrote to memory of 1228 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 84 PID 5304 wrote to memory of 1228 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 84 PID 5304 wrote to memory of 1228 5304 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe 84 - System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe"C:\Users\Admin\AppData\Local\Temp\183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5304 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5132
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2664
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1228
-
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5016
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\svhost.exe
- Size 236KB
- SHA256 183e9d0d23ee006d5172ba32d0237b853adf1ed98bc318dc5ee5e1f8fb62b334
- MD5 361c72e2042e5a0ede485b743e1708b2
- SHA1 c0ce83bd865263fdf2cde83893cbdba92adc0491
- SHA512 ca5ac851841caf0de56ec24c6ebff17b82b64d2ba5561cc079d4e1223cb3f32ffeeb8fe287d1541695c15c9ea97d9c7bf20f1f1a0b33b6b912d9a75f101b9f04
- SSDEEP 6144:8THUyAFbF+0kV4R8dKH45l+tUmZ/6TeDR76ccYRkPTt:8Th0E0G4RaK6lkUmZyyD1cYiJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Default\ntuser.dat.LOG2
- Size 536B
- SHA256 31c665b5e825e9b46813b97d73c8f05f9b979876714b0fd75ea15c74233c8734
- MD5 43239074927f59ca736590ed261f9c88
- SHA1 7aa3fa0de62b1e987444e58b0d77c67ed3c09402
- SHA512 8d234e4109cc8fd2097310e6ef19168a61cb4f5eae4e78f5c616173c83bb81e78f889b0ed04b79f5ea711b20d0fb91fe82a6dc03fac151f88b1b77828904f6aa
- MD5 SHA1 SHA512
- Path \Device\HarddiskVolume1\Boot\how_to_back_files.html
- Size 4KB
- SHA256 899c2ef58773ffae270be0d3f8ef68fb58c9e3bfaf11a89ac6b7ae22a41a8026
- MD5 07bc6fa8b3140661bc29be7bd83f49d2
- SHA1 29b8505dbc7753661d35e1c4b79734ad0e4e474b
- SHA512 85ba829c51ad503f24502a3c06594cdf5f05c341ab5c296151828910561e11338afb918c0f185e4cf0912d26ad0459fef0b091228ae5cf9437293463f085e656
- SSDEEP 96:8y+cAl5azrn+DtZogCbAEGVpLZNlAiKFe8LTRjY:8OAl0zaDjSEECpbbKYQu
- MD5 SHA1 SHA512 SSDEEP