Resubmissions
21/09/2022, 15:35
220921-s1bj5scbfr 918/06/2021, 06:44
210618-hbnfahrlfa 1018/06/2021, 06:16
210618-zl79572kwa 10Analysis
-
max time kernel
299s -
max time network
281s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
18/06/2021, 06:44
Static task
static1
Behavioral task
behavioral1
Sample
Windows Session Manager.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
Windows Session Manager.exe
-
Size
278KB
-
MD5
6736b48ac9b71f21d8e41d5a1f27a0a6
-
SHA1
45eb63e779cb9f33209b29a175199a9048bd9035
-
SHA256
5ad38d579fb249b3326a25cffb6f5ffea11b125cda7b61205893432f59a02101
-
SHA512
c009278cd156d72957b5a29cec68eb97a0aad8dba7dc3c7a3bb1bba2c96779c41a89a106d65dcb91880fb5e2a639c1b89c87ba3906dd11f4aa7f76fe1f5de8ad
Score
10/10
Malware Config
Extracted
Path
C:\readme.txt
Ransom Note
All of your files such as Document, photos ,Databases, etc... has been successfully encrypted! are encrypted by Poteston Ransomware
What guarantees do we give to you?
You can send one of your encrypted file from your PC and we decrypt it for free.
and files should not contain valuable information (databases, backups, large excel sheets, etc.).
After payment we will send you the decryption tool that will decrypt all your files.
Contact us using this email address: [email protected]
Attention!
* Do not rename encrypted files.
* Do not try to decrypt your data using third party software, it
Your personal ID : H4za1TkOTMRislVpl+pxDTIqEFNbsRl+X+q9HQCz2H0sbohbWa3BqyW38dI/Pu4W1LLmwudvd/5FOkL+EaMH/BqkPXpocREl7FVtVKruWhhrQkb32tUnIuyo451UV9wJkIUWYgBdGZUIKX6nLTiAk0ka3FNPcd5OpHN6ldxKzso=
Emails
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\ConvertConnect.tiff.Poteston Windows Session Manager.exe File opened for modification C:\Users\Admin\Pictures\FormatRemove.png.Poteston Windows Session Manager.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Session Manager.exe Windows Session Manager.exe -
Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 188 vssadmin.exe 3400 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 200 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeBackupPrivilege 2032 vssvc.exe Token: SeRestorePrivilege 2032 vssvc.exe Token: SeAuditPrivilege 2032 vssvc.exe Token: SeDebugPrivilege 200 taskmgr.exe Token: SeSystemProfilePrivilege 200 taskmgr.exe Token: SeCreateGlobalPrivilege 200 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe 200 taskmgr.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 476 wrote to memory of 3548 476 Windows Session Manager.exe 76 PID 476 wrote to memory of 3548 476 Windows Session Manager.exe 76 PID 476 wrote to memory of 3548 476 Windows Session Manager.exe 76 PID 3548 wrote to memory of 188 3548 cmd.exe 78 PID 3548 wrote to memory of 188 3548 cmd.exe 78 PID 3548 wrote to memory of 188 3548 cmd.exe 78 PID 476 wrote to memory of 2040 476 Windows Session Manager.exe 79 PID 476 wrote to memory of 2040 476 Windows Session Manager.exe 79 PID 476 wrote to memory of 2040 476 Windows Session Manager.exe 79 PID 2040 wrote to memory of 3400 2040 cmd.exe 82 PID 2040 wrote to memory of 3400 2040 cmd.exe 82 PID 2040 wrote to memory of 3400 2040 cmd.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\Windows Session Manager.exe"C:\Users\Admin\AppData\Local\Temp\Windows Session Manager.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:476 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:188
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3400
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2032
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:200
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3324