d57f4a81dcbfd938b8beca24957ea0854a0fe93dcea5d0f24e94412d485de00c

General

Target

elast.exe
Size

79KB
MD5

344d23c036cf33a82cf9a454a90ff274
SHA1

2a650979c1272dd52a3f4374e722f7a1acc72b06
SHA256

d57f4a81dcbfd938b8beca24957ea0854a0fe93dcea5d0f24e94412d485de00c
SHA512

68bcabcc53239d6a64da60b7d25456a766bcd138c06499dcb8d6295f6b26ebdd1fadad533319b7a812c7dace4108bc82367fe685c6ba547670fb75310832a8b8

Score

9^/10

ransomware

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 11 IoCs

Ransomware generally changes the extension on encrypted files.

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\UnlockPop.png => C:\Users\Admin\Pictures\UnlockPop.png.REDTM	elast.exe
File renamed	C:\Users\Admin\Pictures\WriteConvertFrom.raw => C:\Users\Admin\Pictures\WriteConvertFrom.raw.REDTM	elast.exe
File opened for modification	C:\Users\Admin\Pictures\WriteConvertFrom.raw.REDTM	elast.exe
File opened for modification	C:\Users\Admin\Pictures\InvokeClear.crw.REDTM	elast.exe
File renamed	C:\Users\Admin\Pictures\ResolveConvertFrom.tiff => C:\Users\Admin\Pictures\ResolveConvertFrom.tiff.REDTM	elast.exe
File opened for modification	C:\Users\Admin\Pictures\SelectAdd.png.REDTM	elast.exe
File opened for modification	C:\Users\Admin\Pictures\ResolveConvertFrom.tiff.REDTM	elast.exe
File opened for modification	C:\Users\Admin\Pictures\UnlockPop.png.REDTM	elast.exe
File opened for modification	C:\Users\Admin\Pictures\ResolveConvertFrom.tiff	elast.exe
File renamed	C:\Users\Admin\Pictures\InvokeClear.crw => C:\Users\Admin\Pictures\InvokeClear.crw.REDTM	elast.exe
File renamed	C:\Users\Admin\Pictures\SelectAdd.png => C:\Users\Admin\Pictures\SelectAdd.png.REDTM	elast.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

File Deletion

Inhibit System Recovery

pid	Process
1532	vssadmin.exe
2012	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2004	elast.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1620	2004	elast.exe	27
PID 2004 wrote to memory of 1620	2004	elast.exe	27
PID 2004 wrote to memory of 1620	2004	elast.exe	27
PID 2004 wrote to memory of 1620	2004	elast.exe	27
PID 1620 wrote to memory of 1532	1620	cmd.exe	29
PID 1620 wrote to memory of 1532	1620	cmd.exe	29
PID 1620 wrote to memory of 1532	1620	cmd.exe	29
PID 2004 wrote to memory of 1148	2004	elast.exe	33
PID 2004 wrote to memory of 1148	2004	elast.exe	33
PID 2004 wrote to memory of 1148	2004	elast.exe	33
PID 2004 wrote to memory of 1148	2004	elast.exe	33
PID 1148 wrote to memory of 2012	1148	cmd.exe	35
PID 1148 wrote to memory of 2012	1148	cmd.exe	35
PID 1148 wrote to memory of 2012	1148	cmd.exe	35