Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
08-05-2021 12:16
Static task
static1
Behavioral task
behavioral1
Sample
AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe
Resource
win7v20210408
General
-
Target
AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe
-
Size
444KB
-
MD5
fd442753c3895d868eed72f7854e2fba
-
SHA1
477dc12f213dd05a15b61207926b478d3a0d04c7
-
SHA256
aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202
-
SHA512
1a7ff91196019abe9dfa93bfaca299ecd87693ef173560951b4d55f9d0c66355535bef724de26865205419e7638e57c762e332d7eff85187e9695f0a92e1d0c2
Malware Config
Signatures
-
CrypVault
Ransomware family which makes encrypted files look like they have been quarantined by AV.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1288 764 cmd.exe 50 -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 936 bcdedit.exe 1644 bcdedit.exe -
Executes dropped EXE 3 IoCs
pid Process 1720 7za.exe 648 2D4F861D8D.exe 1636 2D4F861D8D.exe -
resource yara_rule behavioral1/memory/1636-83-0x0000000000400000-0x0000000000E28000-memory.dmp upx behavioral1/memory/1636-88-0x0000000000400000-0x000000000041A000-memory.dmp upx -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta 2D4F861D8D.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta 2D4F861D8D.exe -
Loads dropped DLL 5 IoCs
pid Process 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 648 2D4F861D8D.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 648 set thread context of 1636 648 2D4F861D8D.exe 42 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2000 vssadmin.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1628 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 648 2D4F861D8D.exe 1636 2D4F861D8D.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeImpersonatePrivilege 1636 2D4F861D8D.exe Token: SeTcbPrivilege 1636 2D4F861D8D.exe Token: SeChangeNotifyPrivilege 1636 2D4F861D8D.exe Token: SeCreateTokenPrivilege 1636 2D4F861D8D.exe Token: SeBackupPrivilege 1636 2D4F861D8D.exe Token: SeRestorePrivilege 1636 2D4F861D8D.exe Token: SeIncreaseQuotaPrivilege 1636 2D4F861D8D.exe Token: SeAssignPrimaryTokenPrivilege 1636 2D4F861D8D.exe Token: SeIncreaseQuotaPrivilege 780 WMIC.exe Token: SeSecurityPrivilege 780 WMIC.exe Token: SeTakeOwnershipPrivilege 780 WMIC.exe Token: SeLoadDriverPrivilege 780 WMIC.exe Token: SeSystemProfilePrivilege 780 WMIC.exe Token: SeSystemtimePrivilege 780 WMIC.exe Token: SeProfSingleProcessPrivilege 780 WMIC.exe Token: SeIncBasePriorityPrivilege 780 WMIC.exe Token: SeCreatePagefilePrivilege 780 WMIC.exe Token: SeBackupPrivilege 780 WMIC.exe Token: SeRestorePrivilege 780 WMIC.exe Token: SeShutdownPrivilege 780 WMIC.exe Token: SeDebugPrivilege 780 WMIC.exe Token: SeSystemEnvironmentPrivilege 780 WMIC.exe Token: SeRemoteShutdownPrivilege 780 WMIC.exe Token: SeUndockPrivilege 780 WMIC.exe Token: SeManageVolumePrivilege 780 WMIC.exe Token: 33 780 WMIC.exe Token: 34 780 WMIC.exe Token: 35 780 WMIC.exe Token: SeIncreaseQuotaPrivilege 780 WMIC.exe Token: SeSecurityPrivilege 780 WMIC.exe Token: SeTakeOwnershipPrivilege 780 WMIC.exe Token: SeLoadDriverPrivilege 780 WMIC.exe Token: SeSystemProfilePrivilege 780 WMIC.exe Token: SeSystemtimePrivilege 780 WMIC.exe Token: SeProfSingleProcessPrivilege 780 WMIC.exe Token: SeIncBasePriorityPrivilege 780 WMIC.exe Token: SeCreatePagefilePrivilege 780 WMIC.exe Token: SeBackupPrivilege 780 WMIC.exe Token: SeRestorePrivilege 780 WMIC.exe Token: SeShutdownPrivilege 780 WMIC.exe Token: SeDebugPrivilege 780 WMIC.exe Token: SeSystemEnvironmentPrivilege 780 WMIC.exe Token: SeRemoteShutdownPrivilege 780 WMIC.exe Token: SeUndockPrivilege 780 WMIC.exe Token: SeManageVolumePrivilege 780 WMIC.exe Token: 33 780 WMIC.exe Token: 34 780 WMIC.exe Token: 35 780 WMIC.exe Token: SeBackupPrivilege 1684 vssvc.exe Token: SeRestorePrivilege 1684 vssvc.exe Token: SeAuditPrivilege 1684 vssvc.exe Token: SeImpersonatePrivilege 1636 2D4F861D8D.exe Token: SeTcbPrivilege 1636 2D4F861D8D.exe Token: SeChangeNotifyPrivilege 1636 2D4F861D8D.exe Token: SeCreateTokenPrivilege 1636 2D4F861D8D.exe Token: SeBackupPrivilege 1636 2D4F861D8D.exe Token: SeRestorePrivilege 1636 2D4F861D8D.exe Token: SeIncreaseQuotaPrivilege 1636 2D4F861D8D.exe Token: SeAssignPrimaryTokenPrivilege 1636 2D4F861D8D.exe Token: SeImpersonatePrivilege 1636 2D4F861D8D.exe Token: SeTcbPrivilege 1636 2D4F861D8D.exe Token: SeChangeNotifyPrivilege 1636 2D4F861D8D.exe Token: SeCreateTokenPrivilege 1636 2D4F861D8D.exe Token: SeBackupPrivilege 1636 2D4F861D8D.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 648 2D4F861D8D.exe 648 2D4F861D8D.exe 1628 WINWORD.EXE 1628 WINWORD.EXE 1628 WINWORD.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1820 wrote to memory of 1168 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 26 PID 1820 wrote to memory of 1168 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 26 PID 1820 wrote to memory of 1168 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 26 PID 1820 wrote to memory of 1168 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 26 PID 1820 wrote to memory of 1928 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 28 PID 1820 wrote to memory of 1928 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 28 PID 1820 wrote to memory of 1928 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 28 PID 1820 wrote to memory of 1928 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 28 PID 1820 wrote to memory of 1952 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 30 PID 1820 wrote to memory of 1952 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 30 PID 1820 wrote to memory of 1952 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 30 PID 1820 wrote to memory of 1952 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 30 PID 1820 wrote to memory of 1720 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 32 PID 1820 wrote to memory of 1720 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 32 PID 1820 wrote to memory of 1720 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 32 PID 1820 wrote to memory of 1720 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 32 PID 1820 wrote to memory of 1204 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 34 PID 1820 wrote to memory of 1204 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 34 PID 1820 wrote to memory of 1204 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 34 PID 1820 wrote to memory of 1204 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 34 PID 1820 wrote to memory of 1628 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 36 PID 1820 wrote to memory of 1628 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 36 PID 1820 wrote to memory of 1628 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 36 PID 1820 wrote to memory of 1628 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 36 PID 1820 wrote to memory of 1624 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 37 PID 1820 wrote to memory of 1624 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 37 PID 1820 wrote to memory of 1624 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 37 PID 1820 wrote to memory of 1624 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 37 PID 1820 wrote to memory of 648 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 39 PID 1820 wrote to memory of 648 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 39 PID 1820 wrote to memory of 648 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 39 PID 1820 wrote to memory of 648 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 39 PID 1820 wrote to memory of 616 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 40 PID 1820 wrote to memory of 616 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 40 PID 1820 wrote to memory of 616 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 40 PID 1820 wrote to memory of 616 1820 AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe 40 PID 648 wrote to memory of 1636 648 2D4F861D8D.exe 42 PID 648 wrote to memory of 1636 648 2D4F861D8D.exe 42 PID 648 wrote to memory of 1636 648 2D4F861D8D.exe 42 PID 648 wrote to memory of 1636 648 2D4F861D8D.exe 42 PID 648 wrote to memory of 1636 648 2D4F861D8D.exe 42 PID 648 wrote to memory of 1636 648 2D4F861D8D.exe 42 PID 648 wrote to memory of 1636 648 2D4F861D8D.exe 42 PID 648 wrote to memory of 1636 648 2D4F861D8D.exe 42 PID 648 wrote to memory of 1636 648 2D4F861D8D.exe 42 PID 648 wrote to memory of 1636 648 2D4F861D8D.exe 42 PID 648 wrote to memory of 1636 648 2D4F861D8D.exe 42 PID 1636 wrote to memory of 920 1636 2D4F861D8D.exe 43 PID 1636 wrote to memory of 920 1636 2D4F861D8D.exe 43 PID 1636 wrote to memory of 920 1636 2D4F861D8D.exe 43 PID 1636 wrote to memory of 920 1636 2D4F861D8D.exe 43 PID 1636 wrote to memory of 780 1636 2D4F861D8D.exe 44 PID 1636 wrote to memory of 780 1636 2D4F861D8D.exe 44 PID 1636 wrote to memory of 780 1636 2D4F861D8D.exe 44 PID 1636 wrote to memory of 780 1636 2D4F861D8D.exe 44 PID 1288 wrote to memory of 2000 1288 cmd.exe 54 PID 1288 wrote to memory of 2000 1288 cmd.exe 54 PID 1288 wrote to memory of 2000 1288 cmd.exe 54 PID 1288 wrote to memory of 936 1288 cmd.exe 59 PID 1288 wrote to memory of 936 1288 cmd.exe 59 PID 1288 wrote to memory of 936 1288 cmd.exe 59 PID 1288 wrote to memory of 1644 1288 cmd.exe 60 PID 1288 wrote to memory of 1644 1288 cmd.exe 60 PID 1288 wrote to memory of 1644 1288 cmd.exe 60
Processes
-
C:\Users\Admin\AppData\Local\Temp\AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe"C:\Users\Admin\AppData\Local\Temp\AADDE71205336CCDD048F0B5029BECBBCD03E741045F4.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo 2D4F861D8DCF8C8F2⤵PID:1168
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\CF8C8F" 7za.exe2⤵PID:1928
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo 2D4F861D8DCF8C8F2⤵PID:1952
-
-
C:\Users\Admin\AppData\Local\Temp\7za.exe"C:\Users\Admin\AppData\Local\Temp\7za.exe" e "C:\Users\Admin\AppData\Local\Temp\2D4F861D8D" -y -p2D4F861D8D2⤵
- Executes dropped EXE
PID:1720
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo 2D4F861D8DCF8C8F2⤵PID:1204
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2D4F861D8D.doc"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1628 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:236
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo 2D4F861D8DCF8C8F2⤵PID:1624
-
-
C:\Users\Admin\AppData\Local\Temp\2D4F861D8D.exe"C:\Users\Admin\AppData\Local\Temp\2D4F861D8D.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Users\Admin\AppData\Local\Temp\2D4F861D8D.exe"C:\Users\Admin\AppData\Local\Temp\2D4F861D8D.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\VAULT.hta"4⤵
- Modifies Internet Explorer settings
PID:920
-
-
C:\Windows\SysWOW64\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" process call create "cmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:780
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo 2D4F861D8DCF8C8F2⤵PID:616
-
-
C:\Windows\system32\cmd.execmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:2000
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no2⤵
- Modifies boot configuration data using bcdedit
PID:936
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:1644
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1684