bb7e2066f53bdbb8e93edfa8e900d5be3e2d00ca0a59f9feaa8b8107db7a5d4d

General

Target

test_redeemer.exe
Size

1.8MB
MD5

e37a0ece30267233f1dddf3c2300393f
SHA1

27610367c41c1b8d3a26885b40fd7aac748189b2
SHA256

bb7e2066f53bdbb8e93edfa8e900d5be3e2d00ca0a59f9feaa8b8107db7a5d4d
SHA512

a0e5ceafb39f9ad3774d6a250646bae5f5595c1330bef3df7d448778ee519bc35ce221526c1a4d3db88107b5ccf1b465eef11e5b00cfc680bcdb9cea92ba87c2

Score

9^/10

evasion ransomware

Malware Config

Signatures

Clears Windows event logs 1 TTPs
evasion ransomware

Indicator Removal on Host
T1070
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

2748 svchost.exe

pid	process
2748	svchost.exe

Modifies extensions of user files 7 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

svchost.exe

description	ioc	process
File created	C:\Users\Admin\Pictures\ConvertFromGroup.raw.redeem	svchost.exe
File created	C:\Users\Admin\Pictures\NewMount.raw.redeem	svchost.exe
File created	C:\Users\Admin\Pictures\OptimizeUse.tiff.redeem	svchost.exe
File created	C:\Users\Admin\Pictures\StepSet.raw.redeem	svchost.exe
File created	C:\Users\Admin\Pictures\UnpublishInstall.png.redeem	svchost.exe
File created	C:\Users\Admin\Pictures\WaitProtect.crw.redeem	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\OptimizeUse.tiff	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

test_redeemer.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	test_redeemer.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

2748 svchost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2180 vssadmin.exe

pid	process
2748	svchost.exe

pid	process
2180	vssadmin.exe

Modifies registry class 1 IoCs

Processes:

test_redeemer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	test_redeemer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

vssvc.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exesvchost.exe

description	pid	process
Token: SeBackupPrivilege	1968	vssvc.exe
Token: SeRestorePrivilege	1968	vssvc.exe
Token: SeAuditPrivilege	1968	vssvc.exe
Token: SeSecurityPrivilege	3400	wevtutil.exe
Token: SeBackupPrivilege	3400	wevtutil.exe
Token: SeSecurityPrivilege	852	wevtutil.exe
Token: SeBackupPrivilege	852	wevtutil.exe
Token: SeSecurityPrivilege	2780	wevtutil.exe
Token: SeBackupPrivilege	2780	wevtutil.exe
Token: SeSecurityPrivilege	8	wevtutil.exe
Token: SeBackupPrivilege	8	wevtutil.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe
Token: SeTakeOwnershipPrivilege	2748	svchost.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

test_redeemer.exesvchost.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2208 wrote to memory of 2748	2208	test_redeemer.exe	svchost.exe
PID 2208 wrote to memory of 2748	2208	test_redeemer.exe	svchost.exe
PID 2208 wrote to memory of 2748	2208	test_redeemer.exe	svchost.exe
PID 2748 wrote to memory of 2820	2748	svchost.exe	cmd.exe
PID 2748 wrote to memory of 2820	2748	svchost.exe	cmd.exe
PID 2748 wrote to memory of 2820	2748	svchost.exe	cmd.exe
PID 2820 wrote to memory of 2180	2820	cmd.exe	vssadmin.exe
PID 2820 wrote to memory of 2180	2820	cmd.exe	vssadmin.exe
PID 2820 wrote to memory of 2180	2820	cmd.exe	vssadmin.exe
PID 2748 wrote to memory of 2208	2748	svchost.exe	cmd.exe
PID 2748 wrote to memory of 2208	2748	svchost.exe	cmd.exe
PID 2748 wrote to memory of 2208	2748	svchost.exe	cmd.exe
PID 2208 wrote to memory of 3400	2208	cmd.exe	wevtutil.exe
PID 2208 wrote to memory of 3400	2208	cmd.exe	wevtutil.exe
PID 2208 wrote to memory of 3400	2208	cmd.exe	wevtutil.exe
PID 2748 wrote to memory of 3672	2748	svchost.exe	cmd.exe
PID 2748 wrote to memory of 3672	2748	svchost.exe	cmd.exe
PID 2748 wrote to memory of 3672	2748	svchost.exe	cmd.exe
PID 3672 wrote to memory of 852	3672	cmd.exe	wevtutil.exe
PID 3672 wrote to memory of 852	3672	cmd.exe	wevtutil.exe
PID 3672 wrote to memory of 852	3672	cmd.exe	wevtutil.exe
PID 2748 wrote to memory of 896	2748	svchost.exe	cmd.exe
PID 2748 wrote to memory of 896	2748	svchost.exe	cmd.exe
PID 2748 wrote to memory of 896	2748	svchost.exe	cmd.exe
PID 896 wrote to memory of 2780	896	cmd.exe	wevtutil.exe
PID 896 wrote to memory of 2780	896	cmd.exe	wevtutil.exe
PID 896 wrote to memory of 2780	896	cmd.exe	wevtutil.exe
PID 2748 wrote to memory of 3836	2748	svchost.exe	cmd.exe
PID 2748 wrote to memory of 3836	2748	svchost.exe	cmd.exe
PID 2748 wrote to memory of 3836	2748	svchost.exe	cmd.exe
PID 3836 wrote to memory of 8	3836	cmd.exe	wevtutil.exe
PID 3836 wrote to memory of 8	3836	cmd.exe	wevtutil.exe
PID 3836 wrote to memory of 8	3836	cmd.exe	wevtutil.exe

C:\Users\Admin\AppData\Local\Temp\test_redeemer.exe
"C:\Users\Admin\AppData\Local\Temp\test_redeemer.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\TEMP\svchost.exe
"C:\Windows\TEMP\svchost.exe" C:\Users\Admin\AppData\Local\Temp\test_redeemer.exe
2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Deletes itself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2748

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c vssadmin delete shadows /All /Quiet
3⤵
- Suspicious use of WriteProcessMemory
PID:2820

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /All /Quiet
4⤵
- Interacts with shadow copies
PID:2180

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c wevtutil clear-log Application
3⤵
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\SysWOW64\wevtutil.exe
wevtutil clear-log Application
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3400

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c wevtutil clear-log Security
3⤵
- Suspicious use of WriteProcessMemory
PID:3672

C:\Windows\SysWOW64\wevtutil.exe
wevtutil clear-log Security
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:852

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c wevtutil clear-log Setup
3⤵
- Suspicious use of WriteProcessMemory
PID:896

C:\Windows\SysWOW64\wevtutil.exe
wevtutil clear-log Setup
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2780

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c wevtutil clear-log System
3⤵
- Suspicious use of WriteProcessMemory
PID:3836

C:\Windows\SysWOW64\wevtutil.exe
wevtutil clear-log System
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:8

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1968

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Read Me.TXT
1⤵
PID:1104

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal on Host

1

T1070

File Deletion

2

T1107

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\Read Me.TXT
MD5
8399d77548bbdd4cd8020f27ceba399e

SHA1
af1be979ead3fe438fc444030aa03c5b55960329

SHA256
c969cd9195baf8f224418f8bdc90ba2b82f9fc02560b6442a5ce98cd7de982a4

SHA512
65d00b9e7890ca12adf8e561fc4b9b8064e1fdf683d9909a37177920d11283a72fccfda10dd4dd34d191d19e24098bd0e06ba6b0c42cf134522fbe80aa08ff25

Download Submit
C:\Windows\TEMP\svchost.exe
MD5
e37a0ece30267233f1dddf3c2300393f

SHA1
27610367c41c1b8d3a26885b40fd7aac748189b2

SHA256
bb7e2066f53bdbb8e93edfa8e900d5be3e2d00ca0a59f9feaa8b8107db7a5d4d

SHA512
a0e5ceafb39f9ad3774d6a250646bae5f5595c1330bef3df7d448778ee519bc35ce221526c1a4d3db88107b5ccf1b465eef11e5b00cfc680bcdb9cea92ba87c2

Download Submit
C:\Windows\Temp\svchost.exe
MD5
e37a0ece30267233f1dddf3c2300393f

SHA1
27610367c41c1b8d3a26885b40fd7aac748189b2

SHA256
bb7e2066f53bdbb8e93edfa8e900d5be3e2d00ca0a59f9feaa8b8107db7a5d4d

SHA512
a0e5ceafb39f9ad3774d6a250646bae5f5595c1330bef3df7d448778ee519bc35ce221526c1a4d3db88107b5ccf1b465eef11e5b00cfc680bcdb9cea92ba87c2

Download Submit
memory/8-126-0x0000000000000000-mapping.dmp

Download
memory/852-122-0x0000000000000000-mapping.dmp

Download
memory/896-123-0x0000000000000000-mapping.dmp

Download
memory/2180-118-0x0000000000000000-mapping.dmp

Download
memory/2208-119-0x0000000000000000-mapping.dmp

Download
memory/2748-114-0x0000000000000000-mapping.dmp

Download
memory/2780-124-0x0000000000000000-mapping.dmp

Download
memory/2820-117-0x0000000000000000-mapping.dmp

Download
memory/3400-120-0x0000000000000000-mapping.dmp

Download
memory/3672-121-0x0000000000000000-mapping.dmp

Download
memory/3836-125-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads