Analysis
-
max time kernel
120s -
max time network
156s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 01:18
Static task
static1
Behavioral task
behavioral1
Sample
af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe
Resource
win10-en-20211208
General
-
Target
af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe
-
Size
164KB
-
MD5
9935b34b16a93eb2ef874cfd4501cb7f
-
SHA1
4871435f17541c2c0cf01092bcd38d4869368a08
-
SHA256
af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485
-
SHA512
55391e39d8096a7103851f8ca7de7de99866ceb66138728db736da8840bf17fdfac256638634d02a079beaacce36e0f7d117cef2109094921da2fe0c7f01804e
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exedescription ioc process File opened (read-only) \??\A: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\J: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\N: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\O: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\P: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\X: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\F: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\I: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\K: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\L: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\M: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\Q: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\S: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\T: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\B: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\E: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\W: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\Z: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\U: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\V: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\R: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\Y: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\G: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe File opened (read-only) \??\H: af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2588 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exepid process 696 af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe 696 af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 596 vssvc.exe Token: SeRestorePrivilege 596 vssvc.exe Token: SeAuditPrivilege 596 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.execmd.exedescription pid process target process PID 696 wrote to memory of 2816 696 af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe cmd.exe PID 696 wrote to memory of 2816 696 af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe cmd.exe PID 696 wrote to memory of 2816 696 af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe cmd.exe PID 2816 wrote to memory of 2588 2816 cmd.exe vssadmin.exe PID 2816 wrote to memory of 2588 2816 cmd.exe vssadmin.exe PID 2816 wrote to memory of 2588 2816 cmd.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe"C:\Users\Admin\AppData\Local\Temp\af4dcedf21ec3d03de8eb119108c184371ab2422d5bf9eaff034c129ac39a485.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken