bb7e2066f53bdbb8e93edfa8e900d5be3e2d00ca0a59f9feaa8b8107db7a5d4d

General

Target

test_redeemer.exe
Size

1.8MB
MD5

e37a0ece30267233f1dddf3c2300393f
SHA1

27610367c41c1b8d3a26885b40fd7aac748189b2
SHA256

bb7e2066f53bdbb8e93edfa8e900d5be3e2d00ca0a59f9feaa8b8107db7a5d4d
SHA512

a0e5ceafb39f9ad3774d6a250646bae5f5595c1330bef3df7d448778ee519bc35ce221526c1a4d3db88107b5ccf1b465eef11e5b00cfc680bcdb9cea92ba87c2

Score

9^/10

evasion ransomware spyware stealer

Malware Config

Signatures

Clears Windows event logs 1 TTPs
evasion ransomware

Indicator Removal on Host
T1070
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Executes dropped EXE 1 IoCs

Processes:

sqlservr.exe

pid process

568 sqlservr.exe

pid	process
568	sqlservr.exe

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

sqlservr.exe

description	ioc	process
File created	C:\Users\Admin\Pictures\PushRedo.png.redeem	sqlservr.exe
File created	C:\Users\Admin\Pictures\MountSwitch.raw.redeem	sqlservr.exe
File created	C:\Users\Admin\Pictures\ResizeComplete.crw.redeem	sqlservr.exe
File created	C:\Users\Admin\Pictures\UninstallBlock.crw.redeem	sqlservr.exe
File created	C:\Users\Admin\Pictures\RegisterRead.png.redeem	sqlservr.exe

Deletes itself 1 IoCs

Processes:

sqlservr.exe

pid process

568 sqlservr.exe
Loads dropped DLL 1 IoCs

Processes:

test_redeemer.exe

pid process

1832 test_redeemer.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
568	sqlservr.exe

pid	process
1832	test_redeemer.exe

Drops desktop.ini file(s) 16 IoCs

Processes:

sqlservr.exe

description	ioc	process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	sqlservr.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	sqlservr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	sqlservr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	sqlservr.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	sqlservr.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	sqlservr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	sqlservr.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	sqlservr.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	sqlservr.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	sqlservr.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	sqlservr.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	sqlservr.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	sqlservr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	sqlservr.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	sqlservr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	sqlservr.exe

Drops file in Windows directory 3 IoCs

Processes:

test_redeemer.exe

description	ioc	process
File opened for modification	C:\Windows\SQL\	test_redeemer.exe
File created	C:\Windows\SQL\sqlservr.exe	test_redeemer.exe
File opened for modification	C:\Windows\SQL\sqlservr.exe	test_redeemer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

820 vssadmin.exe

pid	process
820	vssadmin.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

vssvc.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exesqlservr.exe

description	pid	process
Token: SeBackupPrivilege	864	vssvc.exe
Token: SeRestorePrivilege	864	vssvc.exe
Token: SeAuditPrivilege	864	vssvc.exe
Token: SeSecurityPrivilege	1680	wevtutil.exe
Token: SeBackupPrivilege	1680	wevtutil.exe
Token: SeSecurityPrivilege	1956	wevtutil.exe
Token: SeBackupPrivilege	1956	wevtutil.exe
Token: SeSecurityPrivilege	1036	wevtutil.exe
Token: SeBackupPrivilege	1036	wevtutil.exe
Token: SeSecurityPrivilege	832	wevtutil.exe
Token: SeBackupPrivilege	832	wevtutil.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe
Token: SeTakeOwnershipPrivilege	568	sqlservr.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

test_redeemer.exesqlservr.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1832 wrote to memory of 568	1832	test_redeemer.exe	sqlservr.exe
PID 1832 wrote to memory of 568	1832	test_redeemer.exe	sqlservr.exe
PID 1832 wrote to memory of 568	1832	test_redeemer.exe	sqlservr.exe
PID 1832 wrote to memory of 568	1832	test_redeemer.exe	sqlservr.exe
PID 568 wrote to memory of 240	568	sqlservr.exe	cmd.exe
PID 568 wrote to memory of 240	568	sqlservr.exe	cmd.exe
PID 568 wrote to memory of 240	568	sqlservr.exe	cmd.exe
PID 568 wrote to memory of 240	568	sqlservr.exe	cmd.exe
PID 240 wrote to memory of 820	240	cmd.exe	vssadmin.exe
PID 240 wrote to memory of 820	240	cmd.exe	vssadmin.exe
PID 240 wrote to memory of 820	240	cmd.exe	vssadmin.exe
PID 240 wrote to memory of 820	240	cmd.exe	vssadmin.exe
PID 568 wrote to memory of 608	568	sqlservr.exe	cmd.exe
PID 568 wrote to memory of 608	568	sqlservr.exe	cmd.exe
PID 568 wrote to memory of 608	568	sqlservr.exe	cmd.exe
PID 568 wrote to memory of 608	568	sqlservr.exe	cmd.exe
PID 608 wrote to memory of 1680	608	cmd.exe	wevtutil.exe
PID 608 wrote to memory of 1680	608	cmd.exe	wevtutil.exe
PID 608 wrote to memory of 1680	608	cmd.exe	wevtutil.exe
PID 608 wrote to memory of 1680	608	cmd.exe	wevtutil.exe
PID 568 wrote to memory of 1044	568	sqlservr.exe	cmd.exe
PID 568 wrote to memory of 1044	568	sqlservr.exe	cmd.exe
PID 568 wrote to memory of 1044	568	sqlservr.exe	cmd.exe
PID 568 wrote to memory of 1044	568	sqlservr.exe	cmd.exe
PID 1044 wrote to memory of 1956	1044	cmd.exe	wevtutil.exe
PID 1044 wrote to memory of 1956	1044	cmd.exe	wevtutil.exe
PID 1044 wrote to memory of 1956	1044	cmd.exe	wevtutil.exe
PID 1044 wrote to memory of 1956	1044	cmd.exe	wevtutil.exe
PID 568 wrote to memory of 1864	568	sqlservr.exe	cmd.exe
PID 568 wrote to memory of 1864	568	sqlservr.exe	cmd.exe
PID 568 wrote to memory of 1864	568	sqlservr.exe	cmd.exe
PID 568 wrote to memory of 1864	568	sqlservr.exe	cmd.exe
PID 1864 wrote to memory of 1036	1864	cmd.exe	wevtutil.exe
PID 1864 wrote to memory of 1036	1864	cmd.exe	wevtutil.exe
PID 1864 wrote to memory of 1036	1864	cmd.exe	wevtutil.exe
PID 1864 wrote to memory of 1036	1864	cmd.exe	wevtutil.exe
PID 568 wrote to memory of 2032	568	sqlservr.exe	cmd.exe
PID 568 wrote to memory of 2032	568	sqlservr.exe	cmd.exe
PID 568 wrote to memory of 2032	568	sqlservr.exe	cmd.exe
PID 568 wrote to memory of 2032	568	sqlservr.exe	cmd.exe
PID 2032 wrote to memory of 832	2032	cmd.exe	wevtutil.exe
PID 2032 wrote to memory of 832	2032	cmd.exe	wevtutil.exe
PID 2032 wrote to memory of 832	2032	cmd.exe	wevtutil.exe
PID 2032 wrote to memory of 832	2032	cmd.exe	wevtutil.exe

C:\Users\Admin\AppData\Local\Temp\test_redeemer.exe
"C:\Users\Admin\AppData\Local\Temp\test_redeemer.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\SQL\sqlservr.exe
"C:\Windows\SQL\sqlservr.exe" C:\Users\Admin\AppData\Local\Temp\test_redeemer.exe
2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Deletes itself
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:568

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c vssadmin delete shadows /All /Quiet
3⤵
- Suspicious use of WriteProcessMemory
PID:240

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /All /Quiet
4⤵
- Interacts with shadow copies
PID:820

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c wevtutil clear-log Application
3⤵
- Suspicious use of WriteProcessMemory
PID:608

C:\Windows\SysWOW64\wevtutil.exe
wevtutil clear-log Application
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1680

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c wevtutil clear-log Security
3⤵
- Suspicious use of WriteProcessMemory
PID:1044

C:\Windows\SysWOW64\wevtutil.exe
wevtutil clear-log Security
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1956

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c wevtutil clear-log Setup
3⤵
- Suspicious use of WriteProcessMemory
PID:1864

C:\Windows\SysWOW64\wevtutil.exe
wevtutil clear-log Setup
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1036

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c wevtutil clear-log System
3⤵
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\wevtutil.exe
wevtutil clear-log System
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:832

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:864

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal on Host

1

T1070

File Deletion

2

T1107

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SQL\sqlservr.exe
MD5
e37a0ece30267233f1dddf3c2300393f

SHA1
27610367c41c1b8d3a26885b40fd7aac748189b2

SHA256
bb7e2066f53bdbb8e93edfa8e900d5be3e2d00ca0a59f9feaa8b8107db7a5d4d

SHA512
a0e5ceafb39f9ad3774d6a250646bae5f5595c1330bef3df7d448778ee519bc35ce221526c1a4d3db88107b5ccf1b465eef11e5b00cfc680bcdb9cea92ba87c2

Download Submit
C:\Windows\SQL\sqlservr.exe
MD5
e37a0ece30267233f1dddf3c2300393f

SHA1
27610367c41c1b8d3a26885b40fd7aac748189b2

SHA256
bb7e2066f53bdbb8e93edfa8e900d5be3e2d00ca0a59f9feaa8b8107db7a5d4d

SHA512
a0e5ceafb39f9ad3774d6a250646bae5f5595c1330bef3df7d448778ee519bc35ce221526c1a4d3db88107b5ccf1b465eef11e5b00cfc680bcdb9cea92ba87c2

Download Submit
\Windows\SQL\sqlservr.exe
MD5
e37a0ece30267233f1dddf3c2300393f

SHA1
27610367c41c1b8d3a26885b40fd7aac748189b2

SHA256
bb7e2066f53bdbb8e93edfa8e900d5be3e2d00ca0a59f9feaa8b8107db7a5d4d

SHA512
a0e5ceafb39f9ad3774d6a250646bae5f5595c1330bef3df7d448778ee519bc35ce221526c1a4d3db88107b5ccf1b465eef11e5b00cfc680bcdb9cea92ba87c2

Download Submit
memory/240-65-0x0000000000000000-mapping.dmp

Download
memory/568-61-0x0000000000000000-mapping.dmp

Download
memory/608-67-0x0000000000000000-mapping.dmp

Download
memory/820-66-0x0000000000000000-mapping.dmp

Download
memory/832-74-0x0000000000000000-mapping.dmp

Download
memory/1036-72-0x0000000000000000-mapping.dmp

Download
memory/1044-69-0x0000000000000000-mapping.dmp

Download
memory/1680-68-0x0000000000000000-mapping.dmp

Download
memory/1832-59-0x0000000074D91000-0x0000000074D93000-memory.dmp

Filesize
8KB

Download
memory/1864-71-0x0000000000000000-mapping.dmp

Download
memory/1956-70-0x0000000000000000-mapping.dmp

Download
memory/2032-73-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads