373dd8d9b31679fa1f46779be91f0d8e378af030bffe91de45d150c78e2cae53

General

Target

Compile by raminhk 2.exe
Size

7.9MB
MD5

fb9eb8850ee963bc69583f0227803aef
SHA1

a8c4277662b79d84ebec5f17b83153d364a478a7
SHA256

373dd8d9b31679fa1f46779be91f0d8e378af030bffe91de45d150c78e2cae53
SHA512

2d26b6f014ac2ca6b925ab5dfe259847869d3967754de91c8434f0a932bd2ec844403dfa2bc5b5c3442730c42500e2f0c45d321b416450012aae62128e74942c

Score

9^/10

evasion persistence ransomware vmprotect

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exe

pid process

2704 bcdedit.exe
Disables Task Manager via registry modification
evasion

pid	process
2704	bcdedit.exe

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

Compile by raminhk 2.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\DenyReset.tif => C:\Users\Admin\Pictures\DenyReset.tif.GoNNaCry	Compile by raminhk 2.exe
File renamed	C:\Users\Admin\Pictures\MountDismount.tif => C:\Users\Admin\Pictures\MountDismount.tif.GoNNaCry	Compile by raminhk 2.exe

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral2/memory/424-114-0x00000000002E0000-0x0000000001570000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Compile by raminhk 2.exereg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Infected = "a15ea89b6e566d87d387e161e6697ce2854fea89c9143c6acdb31cca4f79844ea15ea89b6e566d87d387e161e6697ce2"	Compile by raminhk 2.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Security Update = "C:\\Users\\Admin\\WindowsSecurityUpdate.exe /onboot"	reg.exe

Drops desktop.ini file(s) 24 IoCs

Processes:

Compile by raminhk 2.exe

description	ioc	process
File created	C:\Users\Admin\Saved Games\desktop.ini	Compile by raminhk 2.exe
File created	C:\Users\Admin\Videos\desktop.ini	Compile by raminhk 2.exe
File created	C:\Users\Public\Pictures\desktop.ini	Compile by raminhk 2.exe
File created	C:\Users\Public\desktop.ini	Compile by raminhk 2.exe
File created	C:\Users\Admin\Favorites\desktop.ini	Compile by raminhk 2.exe
File created	C:\Users\Admin\Links\desktop.ini	Compile by raminhk 2.exe
File created	C:\Users\Admin\Pictures\desktop.ini	Compile by raminhk 2.exe
File created	C:\Users\Public\AccountPictures\desktop.ini	Compile by raminhk 2.exe
File created	C:\Users\Public\Downloads\desktop.ini	Compile by raminhk 2.exe
File created	C:\Users\Public\Videos\desktop.ini	Compile by raminhk 2.exe
File created	C:\Users\Admin\Documents\desktop.ini	Compile by raminhk 2.exe
File created	C:\Users\Admin\Favorites\Links\desktop.ini	Compile by raminhk 2.exe
File created	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	Compile by raminhk 2.exe
File created	C:\Users\Admin\Desktop\desktop.ini	Compile by raminhk 2.exe
File created	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	Compile by raminhk 2.exe
File created	C:\Users\Public\Music\desktop.ini	Compile by raminhk 2.exe
File created	C:\Users\Admin\OneDrive\desktop.ini	Compile by raminhk 2.exe
File created	C:\Users\Admin\Searches\desktop.ini	Compile by raminhk 2.exe
File created	C:\Users\Public\Desktop\desktop.ini	Compile by raminhk 2.exe
File created	C:\Users\Public\Documents\desktop.ini	Compile by raminhk 2.exe
File created	C:\Users\Public\Libraries\desktop.ini	Compile by raminhk 2.exe
File created	C:\Users\Admin\Contacts\desktop.ini	Compile by raminhk 2.exe
File created	C:\Users\Admin\Downloads\desktop.ini	Compile by raminhk 2.exe
File created	C:\Users\Admin\Music\desktop.ini	Compile by raminhk 2.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

2608 tasklist.exe
Modifies registry key 1 TTPs 2 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exe

pid process

2340 reg.exe
1652 reg.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Compile by raminhk 2.exe

pid process

424 Compile by raminhk 2.exe
424 Compile by raminhk 2.exe

pid	process
2608	tasklist.exe

pid	process
2340	reg.exe
1652	reg.exe

pid	process
424	Compile by raminhk 2.exe
424	Compile by raminhk 2.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

tasklist.exeWMIC.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	2608	tasklist.exe
Token: SeIncreaseQuotaPrivilege	1548	WMIC.exe
Token: SeSecurityPrivilege	1548	WMIC.exe
Token: SeTakeOwnershipPrivilege	1548	WMIC.exe
Token: SeLoadDriverPrivilege	1548	WMIC.exe
Token: SeSystemProfilePrivilege	1548	WMIC.exe
Token: SeSystemtimePrivilege	1548	WMIC.exe
Token: SeProfSingleProcessPrivilege	1548	WMIC.exe
Token: SeIncBasePriorityPrivilege	1548	WMIC.exe
Token: SeCreatePagefilePrivilege	1548	WMIC.exe
Token: SeBackupPrivilege	1548	WMIC.exe
Token: SeRestorePrivilege	1548	WMIC.exe
Token: SeShutdownPrivilege	1548	WMIC.exe
Token: SeDebugPrivilege	1548	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1548	WMIC.exe
Token: SeRemoteShutdownPrivilege	1548	WMIC.exe
Token: SeUndockPrivilege	1548	WMIC.exe
Token: SeManageVolumePrivilege	1548	WMIC.exe
Token: 33	1548	WMIC.exe
Token: 34	1548	WMIC.exe
Token: 35	1548	WMIC.exe
Token: 36	1548	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1548	WMIC.exe
Token: SeSecurityPrivilege	1548	WMIC.exe
Token: SeTakeOwnershipPrivilege	1548	WMIC.exe
Token: SeLoadDriverPrivilege	1548	WMIC.exe
Token: SeSystemProfilePrivilege	1548	WMIC.exe
Token: SeSystemtimePrivilege	1548	WMIC.exe
Token: SeProfSingleProcessPrivilege	1548	WMIC.exe
Token: SeIncBasePriorityPrivilege	1548	WMIC.exe
Token: SeCreatePagefilePrivilege	1548	WMIC.exe
Token: SeBackupPrivilege	1548	WMIC.exe
Token: SeRestorePrivilege	1548	WMIC.exe
Token: SeShutdownPrivilege	1548	WMIC.exe
Token: SeDebugPrivilege	1548	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1548	WMIC.exe
Token: SeRemoteShutdownPrivilege	1548	WMIC.exe
Token: SeUndockPrivilege	1548	WMIC.exe
Token: SeManageVolumePrivilege	1548	WMIC.exe
Token: 33	1548	WMIC.exe
Token: 34	1548	WMIC.exe
Token: 35	1548	WMIC.exe
Token: 36	1548	WMIC.exe
Token: SeBackupPrivilege	3908	vssvc.exe
Token: SeRestorePrivilege	3908	vssvc.exe
Token: SeAuditPrivilege	3908	vssvc.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

Compile by raminhk 2.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 424 wrote to memory of 2608	424	Compile by raminhk 2.exe	tasklist.exe
PID 424 wrote to memory of 2608	424	Compile by raminhk 2.exe	tasklist.exe
PID 424 wrote to memory of 2700	424	Compile by raminhk 2.exe	cmd.exe
PID 424 wrote to memory of 2700	424	Compile by raminhk 2.exe	cmd.exe
PID 2700 wrote to memory of 508	2700	cmd.exe	vssadmin.exe
PID 2700 wrote to memory of 508	2700	cmd.exe	vssadmin.exe
PID 2700 wrote to memory of 1548	2700	cmd.exe	WMIC.exe
PID 2700 wrote to memory of 1548	2700	cmd.exe	WMIC.exe
PID 424 wrote to memory of 2008	424	Compile by raminhk 2.exe	cmd.exe
PID 424 wrote to memory of 2008	424	Compile by raminhk 2.exe	cmd.exe
PID 2008 wrote to memory of 2704	2008	cmd.exe	bcdedit.exe
PID 2008 wrote to memory of 2704	2008	cmd.exe	bcdedit.exe
PID 424 wrote to memory of 3556	424	Compile by raminhk 2.exe	cmd.exe
PID 424 wrote to memory of 3556	424	Compile by raminhk 2.exe	cmd.exe
PID 3556 wrote to memory of 2340	3556	cmd.exe	reg.exe
PID 3556 wrote to memory of 2340	3556	cmd.exe	reg.exe
PID 424 wrote to memory of 3652	424	Compile by raminhk 2.exe	cmd.exe
PID 424 wrote to memory of 3652	424	Compile by raminhk 2.exe	cmd.exe
PID 3652 wrote to memory of 1652	3652	cmd.exe	reg.exe
PID 3652 wrote to memory of 1652	3652	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\Compile by raminhk 2.exe
"C:\Users\Admin\AppData\Local\Temp\Compile by raminhk 2.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:424

C:\Windows\system32\tasklist.exe
tasklist /FO csv
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Windows\system32\cmd.exe
cmd /c vssadmin delete shadow /all /quiet & wmic shadowcopy delete & bcdedit /set {default} boostatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -q
2⤵
- Suspicious use of WriteProcessMemory
PID:2700

C:\Windows\system32\vssadmin.exe
vssadmin delete shadow /all /quiet
3⤵
PID:508

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1548

C:\Windows\system32\cmd.exe
cmd /c bcdedit /set {default} recoveryenabled No cmd.exe /C bcdedit /set {default} bootstatuspolicy ignoreallfailures C:\Windows\System32\cmd.exe /C vssadmin.exe Delete Shadows /All Quiet
2⤵
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled No
3⤵
- Modifies boot configuration data using bcdedit
PID:2704

C:\Windows\system32\cmd.exe
cmd /c REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
2⤵
- Suspicious use of WriteProcessMemory
PID:3556

C:\Windows\system32\reg.exe
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
3⤵
- Modifies registry key
PID:2340

C:\Windows\system32\cmd.exe
cmd /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Windows Security Update" /t REG_SZ /d "C:\Users\Admin\WindowsSecurityUpdate.exe /onboot" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:3652

C:\Windows\system32\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Windows Security Update" /t REG_SZ /d "C:\Users\Admin\WindowsSecurityUpdate.exe /onboot" /f
3⤵
- Adds Run key to start application
- Modifies registry key
PID:1652

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3908

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

1

T1107

Modify Registry

2

T1112

Credential Access

Discovery

Process Discovery

1

T1057

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/424-114-0x00000000002E0000-0x0000000001570000-memory.dmp

Filesize
18.6MB

Download
memory/424-115-0x00007FF8A19C0000-0x00007FF8A19C2000-memory.dmp

Filesize
8KB

Download
memory/508-118-0x0000000000000000-mapping.dmp

Download
memory/1548-119-0x0000000000000000-mapping.dmp

Download
memory/1652-125-0x0000000000000000-mapping.dmp

Download
memory/2008-120-0x0000000000000000-mapping.dmp

Download
memory/2340-123-0x0000000000000000-mapping.dmp

Download
memory/2608-116-0x0000000000000000-mapping.dmp

Download
memory/2700-117-0x0000000000000000-mapping.dmp

Download
memory/2704-121-0x0000000000000000-mapping.dmp

Download
memory/3556-122-0x0000000000000000-mapping.dmp

Download
memory/3652-124-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads