Analysis
-
max time kernel
108s -
max time network
32s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27-04-2021 00:12
Static task
static1
Behavioral task
behavioral1
Sample
2fdb9fa88fa2082583d32914c3863521604dd32218c26a0f35e0141ba35408b7.exe
Resource
win7v20210408
General
-
Target
2fdb9fa88fa2082583d32914c3863521604dd32218c26a0f35e0141ba35408b7.exe
-
Size
464KB
-
MD5
fe7bc3cd6512f31d48a58caf3e558fee
-
SHA1
5b2e6e541ea6f47e369291396a5d91564ece2eb8
-
SHA256
2fdb9fa88fa2082583d32914c3863521604dd32218c26a0f35e0141ba35408b7
-
SHA512
26e5d85f46afcf1434ccce85836014a5adf11728a609e79a8d19d2e6da6f84588eb4b650b5b5184b66bd255cb8d4b0a19bbfad65dc7f058928c7e5bc88f1730b
Malware Config
Signatures
-
CrypVault
Ransomware family which makes encrypted files look like they have been quarantined by AV.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1712 1800 cmd.exe 41 -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 904 bcdedit.exe 1668 bcdedit.exe -
Executes dropped EXE 3 IoCs
pid Process 1676 7za.exe 2044 6D00D3EF97.exe 1396 6D00D3EF97.exe -
resource yara_rule behavioral1/memory/1396-78-0x0000000000400000-0x0000000000E28000-memory.dmp upx behavioral1/memory/1396-83-0x0000000000400000-0x000000000041A000-memory.dmp upx -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta 6D00D3EF97.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta 6D00D3EF97.exe -
Loads dropped DLL 5 IoCs
pid Process 736 2fdb9fa88fa2082583d32914c3863521604dd32218c26a0f35e0141ba35408b7.exe 736 2fdb9fa88fa2082583d32914c3863521604dd32218c26a0f35e0141ba35408b7.exe 736 2fdb9fa88fa2082583d32914c3863521604dd32218c26a0f35e0141ba35408b7.exe 736 2fdb9fa88fa2082583d32914c3863521604dd32218c26a0f35e0141ba35408b7.exe 2044 6D00D3EF97.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2044 set thread context of 1396 2044 6D00D3EF97.exe 34 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1696 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1220 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2044 6D00D3EF97.exe 1396 6D00D3EF97.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeImpersonatePrivilege 1396 6D00D3EF97.exe Token: SeTcbPrivilege 1396 6D00D3EF97.exe Token: SeChangeNotifyPrivilege 1396 6D00D3EF97.exe Token: SeCreateTokenPrivilege 1396 6D00D3EF97.exe Token: SeBackupPrivilege 1396 6D00D3EF97.exe Token: SeRestorePrivilege 1396 6D00D3EF97.exe Token: SeIncreaseQuotaPrivilege 1396 6D00D3EF97.exe Token: SeAssignPrimaryTokenPrivilege 1396 6D00D3EF97.exe Token: SeIncreaseQuotaPrivilege 1640 WMIC.exe Token: SeSecurityPrivilege 1640 WMIC.exe Token: SeTakeOwnershipPrivilege 1640 WMIC.exe Token: SeLoadDriverPrivilege 1640 WMIC.exe Token: SeSystemProfilePrivilege 1640 WMIC.exe Token: SeSystemtimePrivilege 1640 WMIC.exe Token: SeProfSingleProcessPrivilege 1640 WMIC.exe Token: SeIncBasePriorityPrivilege 1640 WMIC.exe Token: SeCreatePagefilePrivilege 1640 WMIC.exe Token: SeBackupPrivilege 1640 WMIC.exe Token: SeRestorePrivilege 1640 WMIC.exe Token: SeShutdownPrivilege 1640 WMIC.exe Token: SeDebugPrivilege 1640 WMIC.exe Token: SeSystemEnvironmentPrivilege 1640 WMIC.exe Token: SeRemoteShutdownPrivilege 1640 WMIC.exe Token: SeUndockPrivilege 1640 WMIC.exe Token: SeManageVolumePrivilege 1640 WMIC.exe Token: 33 1640 WMIC.exe Token: 34 1640 WMIC.exe Token: 35 1640 WMIC.exe Token: SeIncreaseQuotaPrivilege 1640 WMIC.exe Token: SeSecurityPrivilege 1640 WMIC.exe Token: SeTakeOwnershipPrivilege 1640 WMIC.exe Token: SeLoadDriverPrivilege 1640 WMIC.exe Token: SeSystemProfilePrivilege 1640 WMIC.exe Token: SeSystemtimePrivilege 1640 WMIC.exe Token: SeProfSingleProcessPrivilege 1640 WMIC.exe Token: SeIncBasePriorityPrivilege 1640 WMIC.exe Token: SeCreatePagefilePrivilege 1640 WMIC.exe Token: SeBackupPrivilege 1640 WMIC.exe Token: SeRestorePrivilege 1640 WMIC.exe Token: SeShutdownPrivilege 1640 WMIC.exe Token: SeDebugPrivilege 1640 WMIC.exe Token: SeSystemEnvironmentPrivilege 1640 WMIC.exe Token: SeRemoteShutdownPrivilege 1640 WMIC.exe Token: SeUndockPrivilege 1640 WMIC.exe Token: SeManageVolumePrivilege 1640 WMIC.exe Token: 33 1640 WMIC.exe Token: 34 1640 WMIC.exe Token: 35 1640 WMIC.exe Token: SeBackupPrivilege 1676 vssvc.exe Token: SeRestorePrivilege 1676 vssvc.exe Token: SeAuditPrivilege 1676 vssvc.exe Token: SeImpersonatePrivilege 1396 6D00D3EF97.exe Token: SeTcbPrivilege 1396 6D00D3EF97.exe Token: SeChangeNotifyPrivilege 1396 6D00D3EF97.exe Token: SeCreateTokenPrivilege 1396 6D00D3EF97.exe Token: SeBackupPrivilege 1396 6D00D3EF97.exe Token: SeRestorePrivilege 1396 6D00D3EF97.exe Token: SeIncreaseQuotaPrivilege 1396 6D00D3EF97.exe Token: SeAssignPrimaryTokenPrivilege 1396 6D00D3EF97.exe Token: SeImpersonatePrivilege 1396 6D00D3EF97.exe Token: SeTcbPrivilege 1396 6D00D3EF97.exe Token: SeChangeNotifyPrivilege 1396 6D00D3EF97.exe Token: SeCreateTokenPrivilege 1396 6D00D3EF97.exe Token: SeBackupPrivilege 1396 6D00D3EF97.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2044 6D00D3EF97.exe 2044 6D00D3EF97.exe 1220 WINWORD.EXE 1220 WINWORD.EXE 1220 WINWORD.EXE -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 736 wrote to memory of 1280 736 2fdb9fa88fa2082583d32914c3863521604dd32218c26a0f35e0141ba35408b7.exe 26 PID 736 wrote to memory of 1280 736 2fdb9fa88fa2082583d32914c3863521604dd32218c26a0f35e0141ba35408b7.exe 26 PID 736 wrote to memory of 1280 736 2fdb9fa88fa2082583d32914c3863521604dd32218c26a0f35e0141ba35408b7.exe 26 PID 736 wrote to memory of 1280 736 2fdb9fa88fa2082583d32914c3863521604dd32218c26a0f35e0141ba35408b7.exe 26 PID 736 wrote to memory of 520 736 2fdb9fa88fa2082583d32914c3863521604dd32218c26a0f35e0141ba35408b7.exe 28 PID 736 wrote to memory of 520 736 2fdb9fa88fa2082583d32914c3863521604dd32218c26a0f35e0141ba35408b7.exe 28 PID 736 wrote to memory of 520 736 2fdb9fa88fa2082583d32914c3863521604dd32218c26a0f35e0141ba35408b7.exe 28 PID 736 wrote to memory of 520 736 2fdb9fa88fa2082583d32914c3863521604dd32218c26a0f35e0141ba35408b7.exe 28 PID 736 wrote to memory of 1676 736 2fdb9fa88fa2082583d32914c3863521604dd32218c26a0f35e0141ba35408b7.exe 30 PID 736 wrote to memory of 1676 736 2fdb9fa88fa2082583d32914c3863521604dd32218c26a0f35e0141ba35408b7.exe 30 PID 736 wrote to memory of 1676 736 2fdb9fa88fa2082583d32914c3863521604dd32218c26a0f35e0141ba35408b7.exe 30 PID 736 wrote to memory of 1676 736 2fdb9fa88fa2082583d32914c3863521604dd32218c26a0f35e0141ba35408b7.exe 30 PID 736 wrote to memory of 1220 736 2fdb9fa88fa2082583d32914c3863521604dd32218c26a0f35e0141ba35408b7.exe 32 PID 736 wrote to memory of 1220 736 2fdb9fa88fa2082583d32914c3863521604dd32218c26a0f35e0141ba35408b7.exe 32 PID 736 wrote to memory of 1220 736 2fdb9fa88fa2082583d32914c3863521604dd32218c26a0f35e0141ba35408b7.exe 32 PID 736 wrote to memory of 1220 736 2fdb9fa88fa2082583d32914c3863521604dd32218c26a0f35e0141ba35408b7.exe 32 PID 736 wrote to memory of 2044 736 2fdb9fa88fa2082583d32914c3863521604dd32218c26a0f35e0141ba35408b7.exe 33 PID 736 wrote to memory of 2044 736 2fdb9fa88fa2082583d32914c3863521604dd32218c26a0f35e0141ba35408b7.exe 33 PID 736 wrote to memory of 2044 736 2fdb9fa88fa2082583d32914c3863521604dd32218c26a0f35e0141ba35408b7.exe 33 PID 736 wrote to memory of 2044 736 2fdb9fa88fa2082583d32914c3863521604dd32218c26a0f35e0141ba35408b7.exe 33 PID 2044 wrote to memory of 1396 2044 6D00D3EF97.exe 34 PID 2044 wrote to memory of 1396 2044 6D00D3EF97.exe 34 PID 2044 wrote to memory of 1396 2044 6D00D3EF97.exe 34 PID 2044 wrote to memory of 1396 2044 6D00D3EF97.exe 34 PID 2044 wrote to memory of 1396 2044 6D00D3EF97.exe 34 PID 2044 wrote to memory of 1396 2044 6D00D3EF97.exe 34 PID 2044 wrote to memory of 1396 2044 6D00D3EF97.exe 34 PID 2044 wrote to memory of 1396 2044 6D00D3EF97.exe 34 PID 2044 wrote to memory of 1396 2044 6D00D3EF97.exe 34 PID 2044 wrote to memory of 1396 2044 6D00D3EF97.exe 34 PID 2044 wrote to memory of 1396 2044 6D00D3EF97.exe 34 PID 1396 wrote to memory of 1428 1396 6D00D3EF97.exe 35 PID 1396 wrote to memory of 1428 1396 6D00D3EF97.exe 35 PID 1396 wrote to memory of 1428 1396 6D00D3EF97.exe 35 PID 1396 wrote to memory of 1428 1396 6D00D3EF97.exe 35 PID 1396 wrote to memory of 1640 1396 6D00D3EF97.exe 36 PID 1396 wrote to memory of 1640 1396 6D00D3EF97.exe 36 PID 1396 wrote to memory of 1640 1396 6D00D3EF97.exe 36 PID 1396 wrote to memory of 1640 1396 6D00D3EF97.exe 36 PID 1712 wrote to memory of 1696 1712 cmd.exe 44 PID 1712 wrote to memory of 1696 1712 cmd.exe 44 PID 1712 wrote to memory of 1696 1712 cmd.exe 44 PID 1712 wrote to memory of 904 1712 cmd.exe 51 PID 1712 wrote to memory of 904 1712 cmd.exe 51 PID 1712 wrote to memory of 904 1712 cmd.exe 51 PID 1712 wrote to memory of 1668 1712 cmd.exe 52 PID 1712 wrote to memory of 1668 1712 cmd.exe 52 PID 1712 wrote to memory of 1668 1712 cmd.exe 52 PID 1220 wrote to memory of 1564 1220 WINWORD.EXE 53 PID 1220 wrote to memory of 1564 1220 WINWORD.EXE 53 PID 1220 wrote to memory of 1564 1220 WINWORD.EXE 53 PID 1220 wrote to memory of 1564 1220 WINWORD.EXE 53
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fdb9fa88fa2082583d32914c3863521604dd32218c26a0f35e0141ba35408b7.exe"C:\Users\Admin\AppData\Local\Temp\2fdb9fa88fa2082583d32914c3863521604dd32218c26a0f35e0141ba35408b7.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo 75BB576D00D3EF972⤵PID:1280
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\75BB57" 7za.exe2⤵PID:520
-
-
C:\Users\Admin\AppData\Local\Temp\7za.exe"C:\Users\Admin\AppData\Local\Temp\7za.exe" e "C:\Users\Admin\AppData\Local\Temp\6D00D3EF97" -y -p6D00D3EF972⤵
- Executes dropped EXE
PID:1676
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\6D00D3EF97.doc"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:1564
-
-
-
C:\Users\Admin\AppData\Local\Temp\6D00D3EF97.exe"C:\Users\Admin\AppData\Local\Temp\6D00D3EF97.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\6D00D3EF97.exeC:\Users\Admin\AppData\Local\Temp\6D00D3EF97.exe3⤵
- Executes dropped EXE
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\VAULT.hta"4⤵
- Modifies Internet Explorer settings
PID:1428
-
-
C:\Windows\SysWOW64\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" process call create "cmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1640
-
-
-
-
C:\Windows\system32\cmd.execmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:1696
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no2⤵
- Modifies boot configuration data using bcdedit
PID:904
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:1668
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1676