75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2

General

Target

75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe
Size

554KB
MD5

7f948cca83d22295814d3235b0b512e4
SHA1

2a6e6e484134cbee198bdf459cb7dcf1bb2378ea
SHA256

75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2
SHA512

58a892c66155f68bc3a9bd11c31e929e0397965c2881f818fb4a32f754031c1ce8cc6938e34cc0c5c7ad2b4b2af6b7778ade9fd5c1ab0a39cf172fdd03611ad0

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ezicehas = "\"C:\\Windows\\onrsidug.exe\""	explorer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe

description	pid	process	target process
PID 1704 set thread context of 908	1704	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe
PID 908 set thread context of 1112	908	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe	explorer.exe

Drops file in Windows directory 2 IoCs

Processes:

explorer.exe

description ioc process

File opened for modification C:\Windows\onrsidug.exe explorer.exe
File created C:\Windows\onrsidug.exe explorer.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1744 vssadmin.exe

description	ioc	process
File opened for modification	C:\Windows\onrsidug.exe	explorer.exe
File created	C:\Windows\onrsidug.exe	explorer.exe

pid	process
1744	vssadmin.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\PhishingFilter	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	explorer.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe

pid process

1704 75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 1216 vssvc.exe
Token: SeRestorePrivilege 1216 vssvc.exe
Token: SeAuditPrivilege 1216 vssvc.exe

pid	process
1704	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe

description	pid	process
Token: SeBackupPrivilege	1216	vssvc.exe
Token: SeRestorePrivilege	1216	vssvc.exe
Token: SeAuditPrivilege	1216	vssvc.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exeexplorer.exe

description	pid	process	target process
PID 1704 wrote to memory of 908	1704	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe
PID 1704 wrote to memory of 908	1704	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe
PID 1704 wrote to memory of 908	1704	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe
PID 1704 wrote to memory of 908	1704	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe
PID 1704 wrote to memory of 908	1704	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe
PID 1704 wrote to memory of 908	1704	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe
PID 1704 wrote to memory of 908	1704	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe
PID 1704 wrote to memory of 908	1704	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe
PID 1704 wrote to memory of 908	1704	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe
PID 1704 wrote to memory of 908	1704	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe
PID 1704 wrote to memory of 908	1704	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe
PID 908 wrote to memory of 1112	908	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe	explorer.exe
PID 908 wrote to memory of 1112	908	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe	explorer.exe
PID 908 wrote to memory of 1112	908	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe	explorer.exe
PID 908 wrote to memory of 1112	908	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe	explorer.exe
PID 908 wrote to memory of 1112	908	75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe	explorer.exe
PID 1112 wrote to memory of 1744	1112	explorer.exe	vssadmin.exe
PID 1112 wrote to memory of 1744	1112	explorer.exe	vssadmin.exe
PID 1112 wrote to memory of 1744	1112	explorer.exe	vssadmin.exe
PID 1112 wrote to memory of 1744	1112	explorer.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe
"C:\Users\Admin\AppData\Local\Temp\75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1704

C:\Users\Admin\AppData\Local\Temp\75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe
"C:\Users\Admin\AppData\Local\Temp\75f2358e8de3ca18b01b53ae652a110e81ae411b9d68a8fb7d5005b89df85bb2.exe"
2⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:908

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\system32\explorer.exe"
3⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer Phishing Filter
- Suspicious use of WriteProcessMemory
PID:1112

C:\Windows\SysWOW64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
4⤵
- Interacts with shadow copies
PID:1744

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1216

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ywynugoxasijikec\01000000
Filesize
554KB

MD5
20d279f022457e1dad52e875b064065f

SHA1
a4d8c2249b7c54befc88d8dfb10ab64b9823a7aa

SHA256
d9286a15d83e707190acac2cb8562ff00dc9f2ea90744be984617a3ec288ca7a

SHA512
126b466ffc440db2ab12f0599a8d29ac7464c4063a8567393e82c3d562979b901179948c362b9091e1d45ad00622178bdaad28b29068ea58948cc62c370d801e

Download Submit
memory/908-55-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/908-66-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/908-69-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/908-68-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/908-61-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/908-60-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/908-58-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/908-65-0x000000000040A61E-mapping.dmp

Download
memory/908-62-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/908-64-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1112-80-0x0000000072931000-0x0000000072933000-memory.dmp

Filesize
8KB

Download
memory/1112-72-0x0000000000350000-0x000000000038C000-memory.dmp

Filesize
240KB

Download
memory/1112-74-0x000000000036A160-mapping.dmp

Download
memory/1112-76-0x0000000074DD1000-0x0000000074DD3000-memory.dmp

Filesize
8KB

Download
memory/1112-77-0x0000000000350000-0x000000000038C000-memory.dmp

Filesize
240KB

Download
memory/1112-70-0x0000000000350000-0x000000000038C000-memory.dmp

Filesize
240KB

Download
memory/1704-54-0x0000000076241000-0x0000000076243000-memory.dmp

Filesize
8KB

Download
memory/1744-79-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads