Analysis
-
max time kernel
107s -
max time network
138s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
12-05-2021 18:45
Static task
static1
Behavioral task
behavioral1
Sample
aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe
Resource
win7v20210410
General
-
Target
aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe
-
Size
444KB
-
MD5
fd442753c3895d868eed72f7854e2fba
-
SHA1
477dc12f213dd05a15b61207926b478d3a0d04c7
-
SHA256
aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202
-
SHA512
1a7ff91196019abe9dfa93bfaca299ecd87693ef173560951b4d55f9d0c66355535bef724de26865205419e7638e57c762e332d7eff85187e9695f0a92e1d0c2
Malware Config
Signatures
-
CrypVault
Ransomware family which makes encrypted files look like they have been quarantined by AV.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3532 3028 cmd.exe 2 -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 3724 bcdedit.exe 1424 bcdedit.exe -
Executes dropped EXE 3 IoCs
pid Process 2252 7za.exe 2136 2D4F861D8D.exe 2204 2D4F861D8D.exe -
resource yara_rule behavioral2/memory/2204-129-0x0000000000400000-0x0000000000E28000-memory.dmp upx behavioral2/memory/2204-134-0x0000000000400000-0x000000000041A000-memory.dmp upx -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta 2D4F861D8D.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta 2D4F861D8D.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2136 set thread context of 2204 2136 2D4F861D8D.exe 92 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1340 vssadmin.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings 2D4F861D8D.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3448 WINWORD.EXE 3448 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2136 2D4F861D8D.exe 2136 2D4F861D8D.exe 2204 2D4F861D8D.exe 2204 2D4F861D8D.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeImpersonatePrivilege 2204 2D4F861D8D.exe Token: SeTcbPrivilege 2204 2D4F861D8D.exe Token: SeChangeNotifyPrivilege 2204 2D4F861D8D.exe Token: SeCreateTokenPrivilege 2204 2D4F861D8D.exe Token: SeBackupPrivilege 2204 2D4F861D8D.exe Token: SeRestorePrivilege 2204 2D4F861D8D.exe Token: SeIncreaseQuotaPrivilege 2204 2D4F861D8D.exe Token: SeAssignPrimaryTokenPrivilege 2204 2D4F861D8D.exe Token: SeIncreaseQuotaPrivilege 200 WMIC.exe Token: SeSecurityPrivilege 200 WMIC.exe Token: SeTakeOwnershipPrivilege 200 WMIC.exe Token: SeLoadDriverPrivilege 200 WMIC.exe Token: SeSystemProfilePrivilege 200 WMIC.exe Token: SeSystemtimePrivilege 200 WMIC.exe Token: SeProfSingleProcessPrivilege 200 WMIC.exe Token: SeIncBasePriorityPrivilege 200 WMIC.exe Token: SeCreatePagefilePrivilege 200 WMIC.exe Token: SeBackupPrivilege 200 WMIC.exe Token: SeRestorePrivilege 200 WMIC.exe Token: SeShutdownPrivilege 200 WMIC.exe Token: SeDebugPrivilege 200 WMIC.exe Token: SeSystemEnvironmentPrivilege 200 WMIC.exe Token: SeRemoteShutdownPrivilege 200 WMIC.exe Token: SeUndockPrivilege 200 WMIC.exe Token: SeManageVolumePrivilege 200 WMIC.exe Token: 33 200 WMIC.exe Token: 34 200 WMIC.exe Token: 35 200 WMIC.exe Token: 36 200 WMIC.exe Token: SeIncreaseQuotaPrivilege 200 WMIC.exe Token: SeSecurityPrivilege 200 WMIC.exe Token: SeTakeOwnershipPrivilege 200 WMIC.exe Token: SeLoadDriverPrivilege 200 WMIC.exe Token: SeSystemProfilePrivilege 200 WMIC.exe Token: SeSystemtimePrivilege 200 WMIC.exe Token: SeProfSingleProcessPrivilege 200 WMIC.exe Token: SeIncBasePriorityPrivilege 200 WMIC.exe Token: SeCreatePagefilePrivilege 200 WMIC.exe Token: SeBackupPrivilege 200 WMIC.exe Token: SeRestorePrivilege 200 WMIC.exe Token: SeShutdownPrivilege 200 WMIC.exe Token: SeDebugPrivilege 200 WMIC.exe Token: SeSystemEnvironmentPrivilege 200 WMIC.exe Token: SeRemoteShutdownPrivilege 200 WMIC.exe Token: SeUndockPrivilege 200 WMIC.exe Token: SeManageVolumePrivilege 200 WMIC.exe Token: 33 200 WMIC.exe Token: 34 200 WMIC.exe Token: 35 200 WMIC.exe Token: 36 200 WMIC.exe Token: SeBackupPrivilege 3856 vssvc.exe Token: SeRestorePrivilege 3856 vssvc.exe Token: SeAuditPrivilege 3856 vssvc.exe Token: SeImpersonatePrivilege 2204 2D4F861D8D.exe Token: SeTcbPrivilege 2204 2D4F861D8D.exe Token: SeChangeNotifyPrivilege 2204 2D4F861D8D.exe Token: SeCreateTokenPrivilege 2204 2D4F861D8D.exe Token: SeBackupPrivilege 2204 2D4F861D8D.exe Token: SeRestorePrivilege 2204 2D4F861D8D.exe Token: SeIncreaseQuotaPrivilege 2204 2D4F861D8D.exe Token: SeAssignPrimaryTokenPrivilege 2204 2D4F861D8D.exe Token: SeImpersonatePrivilege 2204 2D4F861D8D.exe Token: SeTcbPrivilege 2204 2D4F861D8D.exe Token: SeChangeNotifyPrivilege 2204 2D4F861D8D.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2136 2D4F861D8D.exe 2136 2D4F861D8D.exe 3448 WINWORD.EXE 3448 WINWORD.EXE 3448 WINWORD.EXE 3448 WINWORD.EXE -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 2016 wrote to memory of 3540 2016 aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe 76 PID 2016 wrote to memory of 3540 2016 aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe 76 PID 2016 wrote to memory of 3540 2016 aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe 76 PID 2016 wrote to memory of 3472 2016 aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe 78 PID 2016 wrote to memory of 3472 2016 aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe 78 PID 2016 wrote to memory of 3472 2016 aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe 78 PID 2016 wrote to memory of 1276 2016 aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe 80 PID 2016 wrote to memory of 1276 2016 aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe 80 PID 2016 wrote to memory of 1276 2016 aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe 80 PID 2016 wrote to memory of 2252 2016 aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe 82 PID 2016 wrote to memory of 2252 2016 aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe 82 PID 2016 wrote to memory of 2252 2016 aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe 82 PID 2016 wrote to memory of 4000 2016 aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe 84 PID 2016 wrote to memory of 4000 2016 aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe 84 PID 2016 wrote to memory of 4000 2016 aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe 84 PID 2016 wrote to memory of 3448 2016 aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe 86 PID 2016 wrote to memory of 3448 2016 aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe 86 PID 2016 wrote to memory of 1340 2016 aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe 87 PID 2016 wrote to memory of 1340 2016 aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe 87 PID 2016 wrote to memory of 1340 2016 aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe 87 PID 2016 wrote to memory of 2136 2016 aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe 89 PID 2016 wrote to memory of 2136 2016 aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe 89 PID 2016 wrote to memory of 2136 2016 aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe 89 PID 2016 wrote to memory of 2088 2016 aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe 91 PID 2016 wrote to memory of 2088 2016 aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe 91 PID 2016 wrote to memory of 2088 2016 aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe 91 PID 2136 wrote to memory of 2204 2136 2D4F861D8D.exe 92 PID 2136 wrote to memory of 2204 2136 2D4F861D8D.exe 92 PID 2136 wrote to memory of 2204 2136 2D4F861D8D.exe 92 PID 2136 wrote to memory of 2204 2136 2D4F861D8D.exe 92 PID 2136 wrote to memory of 2204 2136 2D4F861D8D.exe 92 PID 2136 wrote to memory of 2204 2136 2D4F861D8D.exe 92 PID 2136 wrote to memory of 2204 2136 2D4F861D8D.exe 92 PID 2136 wrote to memory of 2204 2136 2D4F861D8D.exe 92 PID 2136 wrote to memory of 2204 2136 2D4F861D8D.exe 92 PID 2136 wrote to memory of 2204 2136 2D4F861D8D.exe 92 PID 2136 wrote to memory of 2204 2136 2D4F861D8D.exe 92 PID 2204 wrote to memory of 3956 2204 2D4F861D8D.exe 93 PID 2204 wrote to memory of 3956 2204 2D4F861D8D.exe 93 PID 2204 wrote to memory of 3956 2204 2D4F861D8D.exe 93 PID 2204 wrote to memory of 200 2204 2D4F861D8D.exe 94 PID 2204 wrote to memory of 200 2204 2D4F861D8D.exe 94 PID 2204 wrote to memory of 200 2204 2D4F861D8D.exe 94 PID 3532 wrote to memory of 1340 3532 cmd.exe 99 PID 3532 wrote to memory of 1340 3532 cmd.exe 99 PID 3532 wrote to memory of 3724 3532 cmd.exe 102 PID 3532 wrote to memory of 3724 3532 cmd.exe 102 PID 3532 wrote to memory of 1424 3532 cmd.exe 103 PID 3532 wrote to memory of 1424 3532 cmd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe"C:\Users\Admin\AppData\Local\Temp\aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo 2D4F861D8DCF8C8F2⤵PID:3540
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\Users\Admin\AppData\Local\Temp\CF8C8F" 7za.exe2⤵PID:3472
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo 2D4F861D8DCF8C8F2⤵PID:1276
-
-
C:\Users\Admin\AppData\Local\Temp\7za.exe"C:\Users\Admin\AppData\Local\Temp\7za.exe" e "C:\Users\Admin\AppData\Local\Temp\2D4F861D8D" -y -p2D4F861D8D2⤵
- Executes dropped EXE
PID:2252
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo 2D4F861D8DCF8C8F2⤵PID:4000
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2D4F861D8D.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3448
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo 2D4F861D8DCF8C8F2⤵PID:1340
-
-
C:\Users\Admin\AppData\Local\Temp\2D4F861D8D.exe"C:\Users\Admin\AppData\Local\Temp\2D4F861D8D.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\2D4F861D8D.exe"C:\Users\Admin\AppData\Local\Temp\2D4F861D8D.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\VAULT.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}4⤵PID:3956
-
-
C:\Windows\SysWOW64\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" process call create "cmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:200
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo 2D4F861D8DCF8C8F2⤵PID:2088
-
-
C:\Windows\system32\cmd.execmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:1340
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no2⤵
- Modifies boot configuration data using bcdedit
PID:3724
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:1424
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3856