Analysis
-
max time kernel
152s -
max time network
167s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 22:29
Static task
static1
Behavioral task
behavioral1
Sample
12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe
Resource
win10v2004-20220414-en
General
-
Target
12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe
-
Size
554KB
-
MD5
f915dd718743ef988fba719880e70ef3
-
SHA1
8a25b660c741ccf8a4d6389a16f491499411c953
-
SHA256
12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8
-
SHA512
f105f6b9a8ecd95b57b41eebfb5cd94ff13cf3653e424993da362d6db3a2c721e3d904df63184b51be96488d9c8e7dc98843c0c5daabf0058a52091531db230e
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oqupejyv = "\"C:\\Windows\\inamkxyd.exe\"" explorer.exe -
Processes:
12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exedescription pid process target process PID 1016 set thread context of 1208 1016 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe PID 1208 set thread context of 1772 1208 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe explorer.exe -
Drops file in Windows directory 2 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\Windows\inamkxyd.exe explorer.exe File created C:\Windows\inamkxyd.exe explorer.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1544 vssadmin.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\PhishingFilter explorer.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exepid process 1016 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1480 vssvc.exe Token: SeRestorePrivilege 1480 vssvc.exe Token: SeAuditPrivilege 1480 vssvc.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exeexplorer.exedescription pid process target process PID 1016 wrote to memory of 1208 1016 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe PID 1016 wrote to memory of 1208 1016 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe PID 1016 wrote to memory of 1208 1016 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe PID 1016 wrote to memory of 1208 1016 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe PID 1016 wrote to memory of 1208 1016 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe PID 1016 wrote to memory of 1208 1016 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe PID 1016 wrote to memory of 1208 1016 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe PID 1016 wrote to memory of 1208 1016 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe PID 1016 wrote to memory of 1208 1016 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe PID 1016 wrote to memory of 1208 1016 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe PID 1016 wrote to memory of 1208 1016 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe PID 1208 wrote to memory of 1772 1208 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe explorer.exe PID 1208 wrote to memory of 1772 1208 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe explorer.exe PID 1208 wrote to memory of 1772 1208 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe explorer.exe PID 1208 wrote to memory of 1772 1208 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe explorer.exe PID 1208 wrote to memory of 1772 1208 12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe explorer.exe PID 1772 wrote to memory of 1544 1772 explorer.exe vssadmin.exe PID 1772 wrote to memory of 1544 1772 explorer.exe vssadmin.exe PID 1772 wrote to memory of 1544 1772 explorer.exe vssadmin.exe PID 1772 wrote to memory of 1544 1772 explorer.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe"C:\Users\Admin\AppData\Local\Temp\12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe"C:\Users\Admin\AppData\Local\Temp\12ab1f1809440c6eab000ca0787ad606959cf58be492f068703d2cf38d13cbb8.exe"2⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"3⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer Phishing Filter
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet4⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\ywynugoxasijikec\01000000Filesize
554KB
MD51330462f8c0ad8e7e3b21cdb30c6d267
SHA12dd4f3059f6dd99e21a28575cb2aff0d6635cff6
SHA2569c26f3ef78347a1f197edd9b5398ee1f3f9f109ef264c016317b67deeea854c4
SHA512b8dd37e4a2292b7178250e8df3431007e74acf5196ddddae4cb3c7d6d0bab9fead0a8285fbf01f5ef1bf6360685158de769e31fec8dcbc0fbd0b99212750355e
-
memory/1016-54-0x0000000075F61000-0x0000000075F63000-memory.dmpFilesize
8KB
-
memory/1208-66-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1208-77-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1208-61-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1208-62-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1208-64-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1208-65-0x000000000040A61E-mapping.dmp
-
memory/1208-58-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1208-68-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1208-55-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1208-60-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1544-79-0x0000000000000000-mapping.dmp
-
memory/1772-73-0x000000000009A160-mapping.dmp
-
memory/1772-75-0x0000000074F41000-0x0000000074F43000-memory.dmpFilesize
8KB
-
memory/1772-71-0x0000000000080000-0x00000000000BC000-memory.dmpFilesize
240KB
-
memory/1772-69-0x0000000000080000-0x00000000000BC000-memory.dmpFilesize
240KB
-
memory/1772-78-0x0000000000080000-0x00000000000BC000-memory.dmpFilesize
240KB
-
memory/1772-80-0x0000000072AE1000-0x0000000072AE3000-memory.dmpFilesize
8KB