5ad38d579fb249b3326a25cffb6f5ffea11b125cda7b61205893432f59a02101

General

Target

Windows Session Manager.exe
Size

278KB
MD5

6736b48ac9b71f21d8e41d5a1f27a0a6
SHA1

45eb63e779cb9f33209b29a175199a9048bd9035
SHA256

5ad38d579fb249b3326a25cffb6f5ffea11b125cda7b61205893432f59a02101
SHA512

c009278cd156d72957b5a29cec68eb97a0aad8dba7dc3c7a3bb1bba2c96779c41a89a106d65dcb91880fb5e2a639c1b89c87ba3906dd11f4aa7f76fe1f5de8ad

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\readme.txt

Ransom Note

All of your files such as Document, photos ,Databases, etc... has been successfully encrypted! are encrypted by Poteston Ransomware What guarantees do we give to you? You can send one of your encrypted file from your PC and we decrypt it for free. and files should not contain valuable information (databases, backups, large excel sheets, etc.). After payment we will send you the decryption tool that will decrypt all your files. Contact us using this email address: [email protected] Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it Your personal ID : 71e4g05Zbhuc+s2SSHGlHHWR6uVMHnsvmr3lA5w2wlTDNbbfsKWZ6uv2PUn0hT/+SE3k322k9R+C3GGYtPnig48s/Go0lvwV3ylFNHiVQAJ8Bs0dbyOwVNVYQBTYOD8+cLQpmjXLhg2kxjMFoqUoZgooJ3NiZwiGR6Q+2e3onuw=

Emails

[email protected]

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 7 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\CopyUnregister.tiff.Poteston	Windows Session Manager.exe
File opened for modification	C:\Users\Admin\Pictures\InvokeBackup.png.Poteston	Windows Session Manager.exe
File opened for modification	C:\Users\Admin\Pictures\OpenMove.tif.Poteston	Windows Session Manager.exe
File opened for modification	C:\Users\Admin\Pictures\PublishComplete.raw.Poteston	Windows Session Manager.exe
File opened for modification	C:\Users\Admin\Pictures\TestUnregister.crw.Poteston	Windows Session Manager.exe
File opened for modification	C:\Users\Admin\Pictures\UseReset.tif.Poteston	Windows Session Manager.exe
File opened for modification	C:\Users\Admin\Pictures\ConfirmOut.tiff.Poteston	Windows Session Manager.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Session Manager.exe	Windows Session Manager.exe

Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media
T1091

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
692	vssadmin.exe
1804	vssadmin.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
436	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeBackupPrivilege	1620	vssvc.exe
Token: SeRestorePrivilege	1620	vssvc.exe
Token: SeAuditPrivilege	1620	vssvc.exe
Token: 33	2044	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2044	AUDIODG.EXE
Token: 33	2044	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2044	AUDIODG.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 744	756	Windows Session Manager.exe	30
PID 756 wrote to memory of 744	756	Windows Session Manager.exe	30
PID 756 wrote to memory of 744	756	Windows Session Manager.exe	30
PID 756 wrote to memory of 744	756	Windows Session Manager.exe	30
PID 744 wrote to memory of 692	744	cmd.exe	32
PID 744 wrote to memory of 692	744	cmd.exe	32
PID 744 wrote to memory of 692	744	cmd.exe	32
PID 744 wrote to memory of 692	744	cmd.exe	32
PID 756 wrote to memory of 1588	756	Windows Session Manager.exe	33
PID 756 wrote to memory of 1588	756	Windows Session Manager.exe	33
PID 756 wrote to memory of 1588	756	Windows Session Manager.exe	33
PID 756 wrote to memory of 1588	756	Windows Session Manager.exe	33
PID 1588 wrote to memory of 1804	1588	cmd.exe	36
PID 1588 wrote to memory of 1804	1588	cmd.exe	36
PID 1588 wrote to memory of 1804	1588	cmd.exe	36
PID 1588 wrote to memory of 1804	1588	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\Windows Session Manager.exe
"C:\Users\Admin\AppData\Local\Temp\Windows Session Manager.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c vssadmin.exe delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:692
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c vssadmin.exe delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin.exe delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1804

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1620

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1336

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x500
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2044

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\readme.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/756-59-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/756-61-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/756-62-0x0000000004A50000-0x0000000004A51000-memory.dmp

Filesize
4KB

Download
memory/1336-67-0x000007FEFB531000-0x000007FEFB533000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads