fcc2921020690a58c60eba35df885e575669e9803212f7791d7e1956f9bf8020

General

Target

fcc2921020690a58c60eba35df885e575669e9803212f7791d7e1956f9bf8020.sample.exe
Size

21KB
MD5

ce3cd1dab67814f5f153bccdaf502f4c
SHA1

f246984193c927414e543d936d1fb643a2dff77b
SHA256

fcc2921020690a58c60eba35df885e575669e9803212f7791d7e1956f9bf8020
SHA512

015a9c54e65888cd0bf6e74ec26ddf42ba860b48ca56024a8f822be0cd56ed04fb80891ef21857f5ac65c97f6ecb050a1f1c33d1c5e9afddfcab0c59517a95e4

Score

9^/10

ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

fcc2921020690a58c60eba35df885e575669e9803212f7791d7e1956f9bf8020.sample.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\god.jpg"	fcc2921020690a58c60eba35df885e575669e9803212f7791d7e1956f9bf8020.sample.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 43 IoCs

Processes:

WMIC.exevssvc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1800	WMIC.exe
Token: SeSecurityPrivilege	1800	WMIC.exe
Token: SeTakeOwnershipPrivilege	1800	WMIC.exe
Token: SeLoadDriverPrivilege	1800	WMIC.exe
Token: SeSystemProfilePrivilege	1800	WMIC.exe
Token: SeSystemtimePrivilege	1800	WMIC.exe
Token: SeProfSingleProcessPrivilege	1800	WMIC.exe
Token: SeIncBasePriorityPrivilege	1800	WMIC.exe
Token: SeCreatePagefilePrivilege	1800	WMIC.exe
Token: SeBackupPrivilege	1800	WMIC.exe
Token: SeRestorePrivilege	1800	WMIC.exe
Token: SeShutdownPrivilege	1800	WMIC.exe
Token: SeDebugPrivilege	1800	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1800	WMIC.exe
Token: SeRemoteShutdownPrivilege	1800	WMIC.exe
Token: SeUndockPrivilege	1800	WMIC.exe
Token: SeManageVolumePrivilege	1800	WMIC.exe
Token: 33	1800	WMIC.exe
Token: 34	1800	WMIC.exe
Token: 35	1800	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1800	WMIC.exe
Token: SeSecurityPrivilege	1800	WMIC.exe
Token: SeTakeOwnershipPrivilege	1800	WMIC.exe
Token: SeLoadDriverPrivilege	1800	WMIC.exe
Token: SeSystemProfilePrivilege	1800	WMIC.exe
Token: SeSystemtimePrivilege	1800	WMIC.exe
Token: SeProfSingleProcessPrivilege	1800	WMIC.exe
Token: SeIncBasePriorityPrivilege	1800	WMIC.exe
Token: SeCreatePagefilePrivilege	1800	WMIC.exe
Token: SeBackupPrivilege	1800	WMIC.exe
Token: SeRestorePrivilege	1800	WMIC.exe
Token: SeShutdownPrivilege	1800	WMIC.exe
Token: SeDebugPrivilege	1800	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1800	WMIC.exe
Token: SeRemoteShutdownPrivilege	1800	WMIC.exe
Token: SeUndockPrivilege	1800	WMIC.exe
Token: SeManageVolumePrivilege	1800	WMIC.exe
Token: 33	1800	WMIC.exe
Token: 34	1800	WMIC.exe
Token: 35	1800	WMIC.exe
Token: SeBackupPrivilege	2024	vssvc.exe
Token: SeRestorePrivilege	2024	vssvc.exe
Token: SeAuditPrivilege	2024	vssvc.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

fcc2921020690a58c60eba35df885e575669e9803212f7791d7e1956f9bf8020.sample.execmd.exe

description	pid	process	target process
PID 1820 wrote to memory of 1608	1820	fcc2921020690a58c60eba35df885e575669e9803212f7791d7e1956f9bf8020.sample.exe	cmd.exe
PID 1820 wrote to memory of 1608	1820	fcc2921020690a58c60eba35df885e575669e9803212f7791d7e1956f9bf8020.sample.exe	cmd.exe
PID 1820 wrote to memory of 1608	1820	fcc2921020690a58c60eba35df885e575669e9803212f7791d7e1956f9bf8020.sample.exe	cmd.exe
PID 1820 wrote to memory of 1608	1820	fcc2921020690a58c60eba35df885e575669e9803212f7791d7e1956f9bf8020.sample.exe	cmd.exe
PID 1608 wrote to memory of 1800	1608	cmd.exe	WMIC.exe
PID 1608 wrote to memory of 1800	1608	cmd.exe	WMIC.exe
PID 1608 wrote to memory of 1800	1608	cmd.exe	WMIC.exe
PID 1608 wrote to memory of 1800	1608	cmd.exe	WMIC.exe

C:\Users\Admin\AppData\Local\Temp\fcc2921020690a58c60eba35df885e575669e9803212f7791d7e1956f9bf8020.sample.exe
"C:\Users\Admin\AppData\Local\Temp\fcc2921020690a58c60eba35df885e575669e9803212f7791d7e1956f9bf8020.sample.exe"
1⤵
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet & wmic shadowcopy delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1800

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2024

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Inhibit System Recovery

1

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1608-61-0x0000000000000000-mapping.dmp

Download
memory/1800-62-0x0000000000000000-mapping.dmp

Download
memory/1820-60-0x0000000076641000-0x0000000076643000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads