a3788d8cf37d691627bdbc5add07b598fdde66bdfcdb05299b0976715b392a61

Analysis

max time kernel
119s
max time network
140s
platform
windows10_x64
resource
win10-en-20211208
submitted
15-12-2021 06:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe
Size

79KB
MD5

4b4ed15014cad303edf6ceafedb3d594
SHA1

bc327c544d5cdce1b7112a6ab389a14a803fa2dc
SHA256

12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8
SHA512

bc35af57a4798b7b8490ceb2a74fda06c866a4e0854b3a754fd81cfd2bf8319aedc6da5f9d9ec5caac835f2ddd37a508e9fc8a5748344928c4ace19af9ed133d

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\How To Restore Your Files.txt

Ransom Note

This is the end. All your files have been encrypted. Please contact us at xxxx to decrypt your files

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe

description	ioc	process
File opened (read-only)	\??\Q:	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe
File opened (read-only)	\??\F:	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe
File opened (read-only)	\??\V:	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe
File opened (read-only)	\??\N:	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe
File opened (read-only)	\??\E:	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe
File opened (read-only)	\??\R:	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe
File opened (read-only)	\??\A:	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe
File opened (read-only)	\??\H:	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe
File opened (read-only)	\??\K:	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe
File opened (read-only)	\??\I:	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe
File opened (read-only)	\??\O:	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe
File opened (read-only)	\??\P:	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe
File opened (read-only)	\??\J:	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe
File opened (read-only)	\??\G:	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe
File opened (read-only)	\??\L:	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe
File opened (read-only)	\??\Z:	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe
File opened (read-only)	\??\W:	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe
File opened (read-only)	\??\T:	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe
File opened (read-only)	\??\Y:	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe
File opened (read-only)	\??\U:	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe
File opened (read-only)	\??\S:	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe
File opened (read-only)	\??\X:	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe
File opened (read-only)	\??\B:	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe
File opened (read-only)	\??\M:	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

3096 vssadmin.exe
1160 vssadmin.exe

pid	process
3096	vssadmin.exe
1160	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe

pid	process
4112	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe
4112	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 3140 vssvc.exe
Token: SeRestorePrivilege 3140 vssvc.exe
Token: SeAuditPrivilege 3140 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	3140	vssvc.exe
Token: SeRestorePrivilege	3140	vssvc.exe
Token: SeAuditPrivilege	3140	vssvc.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.execmd.execmd.exe

description	pid	process	target process
PID 4112 wrote to memory of 3456	4112	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe	cmd.exe
PID 4112 wrote to memory of 3456	4112	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe	cmd.exe
PID 3456 wrote to memory of 3096	3456	cmd.exe	vssadmin.exe
PID 3456 wrote to memory of 3096	3456	cmd.exe	vssadmin.exe
PID 4112 wrote to memory of 68	4112	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe	cmd.exe
PID 4112 wrote to memory of 68	4112	12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe	cmd.exe
PID 68 wrote to memory of 1160	68	cmd.exe	vssadmin.exe
PID 68 wrote to memory of 1160	68	cmd.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe
"C:\Users\Admin\AppData\Local\Temp\12c561ac827c3f79afff026b0b1d3ddec7c4b591946e2b794a4d00c423b1c8f8.exe"
1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4112

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
2⤵
- Suspicious use of WriteProcessMemory
PID:3456

C:\Windows\system32\vssadmin.exe
vssadmin.exe delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:3096

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
2⤵
- Suspicious use of WriteProcessMemory
PID:68

C:\Windows\system32\vssadmin.exe
vssadmin.exe delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:1160

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3140

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/68-120-0x0000000000000000-mapping.dmp

Download
memory/1160-121-0x0000000000000000-mapping.dmp

Download
memory/3096-119-0x0000000000000000-mapping.dmp

Download
memory/3456-118-0x0000000000000000-mapping.dmp

Download