f2e3f685256e5f31b05fc9f9ca470f527d7fdae28fa3190c8eba179473e20789

Resubmissions

16/12/2021, 14:03

211216-rcqtgsccb53

14/12/2021, 13:38

211214-qxd5rafge38

Analysis

max time kernel
117s
max time network
146s
platform
windows10_x64
resource
win10-en-20211208
submitted
14/12/2021, 13:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
khonsari.exe
Size 12KB
Sample211214-qxd5rafge3
SHA256 f2e3f685256e5f31b05fc9f9ca470f527d7fdae28fa3190c8eba179473e20789
MD5 6ac57a1e090e7abdb9b7212e058c43c6
SHA1 0a1e239348a73b1a95ac1767c8afebe4b98cdeff
SHA512 95748e2a5c90440206a815960eb864b787562d9dbe5d57a3279ef71d24143ff6f0f963925836623bfcb02914c0c0dea3cc0f731860c88101710659c445287a9e
MD5 SHA1 SHA512

Score

8^/10

ransomware

Malware Config

Signatures

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\ConnectExit.tiff	khonsari.exe
File renamed	C:\Users\Admin\Pictures\ConnectExit.tiff => C:\Users\Admin\Pictures\ConnectExit.tiff.khonsari	khonsari.exe
File renamed	C:\Users\Admin\Pictures\MoveSuspend.raw => C:\Users\Admin\Pictures\MoveSuspend.raw.khonsari	khonsari.exe
File renamed	C:\Users\Admin\Pictures\SearchMeasure.raw => C:\Users\Admin\Pictures\SearchMeasure.raw.khonsari	khonsari.exe
File renamed	C:\Users\Admin\Pictures\SubmitExpand.raw => C:\Users\Admin\Pictures\SubmitExpand.raw.khonsari	khonsari.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings	khonsari.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	712	khonsari.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 712 wrote to memory of 1320	712	khonsari.exe	69
PID 712 wrote to memory of 1320	712	khonsari.exe	69

C:\Users\Admin\AppData\Local\Temp\khonsari.exe
"C:\Users\Admin\AppData\Local\Temp\khonsari.exe"
1⤵
- Modifies extensions of user files
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:712
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\HOW TO GET YOUR FILES BACK.TXT
  2⤵
  PID:1320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/712-115-0x0000000000530000-0x0000000000531000-memory.dmp

Download

memory/712-117-0x000000001B1C0000-0x000000001B1C2000-memory.dmp