Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
05-02-2022 07:08
General
-
Target
60d57c278bab55af5023a16578492fa5_AntiRecuvaAndDB.exe
-
Size
136KB
-
MD5
60d57c278bab55af5023a16578492fa5
-
SHA1
bb7a831d2ee669a52726737765d86bbba4074991
-
SHA256
de6b4fe5b4420970f1615f4d899a3c53e7817ce715db692583e2299f260661b2
-
SHA512
f6528e07a19bfd56343af4d73dff137207830bc0acafa3739f6ff85f88055ed44ddf97de870cc68004ca870c855c63a4bfe90d377636307455623b85f4731cf8
Malware Config
Signatures
-
Detect Neshta Payload 1 IoCs
-
Modifies system executable filetype association 2 TTPs 1 IoCs
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
-
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 3 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 49 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\60d57c278bab55af5023a16578492fa5_AntiRecuvaAndDB.exe"C:\Users\Admin\AppData\Local\Temp\60d57c278bab55af5023a16578492fa5_AntiRecuvaAndDB.exe"1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\60d57c278bab55af5023a16578492fa5_AntiRecuvaAndDB.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\60d57c278bab55af5023a16578492fa5_AntiRecuvaAndDB.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\60d57c278bab55af5023a16578492fa5_AntiRecuvaAndDB.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\60d57c278bab55af5023a16578492fa5_AntiRecuvaAndDB.exe"3⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off4⤵
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable4⤵
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe b89347a4793e93c66bbce143c9152240 2eGbb/W81EK0agOsi/IHWQ.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\StartUp\60D57C~1.EXEMD5
ea6ca220e55dc485188e579cbf841e8b
SHA16c4c57e97d3a49902a7b74010269201268580165
SHA25698f4efc747891dfec1ff14b19e67473d3637238d6570072b090fc7cc349d29cf
SHA5123c8e313ebe5906c0b1a5823c2d38c47c349bb1d202a9e2a8552ff34bb74ef3c42548186536557ff40d74232ebdac9331441d4a31d941b123798567e29200ed28
-
C:\Users\Admin\AppData\Local\60D57C~1.EXEMD5
346060bba164540a48a2c1884d140123
SHA1568de53a8ef80b5c280f0dff005df6ef255c146b
SHA256b2e9524b0f98d2ba59e1be46e563658aed8094dbb2296a0d18f7ec473759867f
SHA512e91eadeab9f231e73a2ff5fb69b5e8ccb2ba744766ec6b1aea501d196b949028c28118f2b176c815655c5ededb3828f1c2513c0257a419196520b3b3f313f964
-
C:\Users\Admin\AppData\Local\Temp\3582-490\60d57c278bab55af5023a16578492fa5_AntiRecuvaAndDB.exeMD5
ea6ca220e55dc485188e579cbf841e8b
SHA16c4c57e97d3a49902a7b74010269201268580165
SHA25698f4efc747891dfec1ff14b19e67473d3637238d6570072b090fc7cc349d29cf
SHA5123c8e313ebe5906c0b1a5823c2d38c47c349bb1d202a9e2a8552ff34bb74ef3c42548186536557ff40d74232ebdac9331441d4a31d941b123798567e29200ed28
-
C:\Users\Admin\AppData\Local\Temp\3582-490\60d57c278bab55af5023a16578492fa5_AntiRecuvaAndDB.exeMD5
ea6ca220e55dc485188e579cbf841e8b
SHA16c4c57e97d3a49902a7b74010269201268580165
SHA25698f4efc747891dfec1ff14b19e67473d3637238d6570072b090fc7cc349d29cf
SHA5123c8e313ebe5906c0b1a5823c2d38c47c349bb1d202a9e2a8552ff34bb74ef3c42548186536557ff40d74232ebdac9331441d4a31d941b123798567e29200ed28
-
C:\Users\Admin\AppData\Local\Temp\3582-490\60d57c278bab55af5023a16578492fa5_AntiRecuvaAndDB.exeMD5
ea6ca220e55dc485188e579cbf841e8b
SHA16c4c57e97d3a49902a7b74010269201268580165
SHA25698f4efc747891dfec1ff14b19e67473d3637238d6570072b090fc7cc349d29cf
SHA5123c8e313ebe5906c0b1a5823c2d38c47c349bb1d202a9e2a8552ff34bb74ef3c42548186536557ff40d74232ebdac9331441d4a31d941b123798567e29200ed28
-
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\60D57C~1.EXEMD5
ea6ca220e55dc485188e579cbf841e8b
SHA16c4c57e97d3a49902a7b74010269201268580165
SHA25698f4efc747891dfec1ff14b19e67473d3637238d6570072b090fc7cc349d29cf
SHA5123c8e313ebe5906c0b1a5823c2d38c47c349bb1d202a9e2a8552ff34bb74ef3c42548186536557ff40d74232ebdac9331441d4a31d941b123798567e29200ed28
-
C:\odt\office2016setup.exeMD5
eaef77887eb853c76c8328b36ca89d26
SHA16392e91a4e094ad2bc939ac2351ccb9c3b3b1fdf
SHA25624afd72b465ee8a1d2ae3594b3d43a6cc1a12baa63f7cbf36d460849a7dda630
SHA5126489f7328e03ab31e5494facaf55d848f9829ac4ddd8db0d0aacf700d777a12e1fa811842459b3b2470af1bfbc4fa8bb380d81cc483a4eb3f9ec4761802eae80