fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9

General

Target

fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe
Size

3.4MB
MD5

9a1a3977773a433cea558de846eebfbc
SHA1

d051dee115c9176a0a2cba13f2ab36d7a1954ab2
SHA256

fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9
SHA512

4cbe419e18ad0fd01f5cd005bb72c4ee1e207c67b428a1b9aacf264843d955cc687aa9367054f0077abce4ee35e9d7f329c44d6615026ae5c8d11165baa7766d

Score

9^/10

ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe

description	ioc	process
File opened (read-only)	\??\T:	fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe
File opened (read-only)	\??\U:	fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe
File opened (read-only)	\??\W:	fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe
File opened (read-only)	\??\A:	fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe
File opened (read-only)	\??\M:	fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe
File opened (read-only)	\??\P:	fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe
File opened (read-only)	\??\S:	fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe
File opened (read-only)	\??\I:	fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe
File opened (read-only)	\??\K:	fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe
File opened (read-only)	\??\R:	fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe
File opened (read-only)	\??\Z:	fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe
File opened (read-only)	\??\Q:	fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe
File opened (read-only)	\??\V:	fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe
File opened (read-only)	\??\B:	fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe
File opened (read-only)	\??\G:	fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe
File opened (read-only)	\??\L:	fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe
File opened (read-only)	\??\N:	fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe
File opened (read-only)	\??\O:	fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe
File opened (read-only)	\??\X:	fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe
File opened (read-only)	\??\Y:	fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe
File opened (read-only)	\??\E:	fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe
File opened (read-only)	\??\F:	fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe
File opened (read-only)	\??\H:	fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe
File opened (read-only)	\??\J:	fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1564 vssadmin.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe

pid process

1628 fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 748 vssvc.exe
Token: SeRestorePrivilege 748 vssvc.exe
Token: SeAuditPrivilege 748 vssvc.exe

pid	process
1564	vssadmin.exe

pid	process
1628	fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe

description	pid	process
Token: SeBackupPrivilege	748	vssvc.exe
Token: SeRestorePrivilege	748	vssvc.exe
Token: SeAuditPrivilege	748	vssvc.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.execmd.exe

description	pid	process	target process
PID 1628 wrote to memory of 620	1628	fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe	cmd.exe
PID 1628 wrote to memory of 620	1628	fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe	cmd.exe
PID 1628 wrote to memory of 620	1628	fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe	cmd.exe
PID 1628 wrote to memory of 620	1628	fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe	cmd.exe
PID 620 wrote to memory of 1564	620	cmd.exe	vssadmin.exe
PID 620 wrote to memory of 1564	620	cmd.exe	vssadmin.exe
PID 620 wrote to memory of 1564	620	cmd.exe	vssadmin.exe
PID 620 wrote to memory of 1564	620	cmd.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe
"C:\Users\Admin\AppData\Local\Temp\fcea5f8fbc7bf1a48611163f4b6db1f80af51f7985ba61a5ce99d72ad0ee56e9.exe"
1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
2⤵
- Suspicious use of WriteProcessMemory
PID:620