Analysis
-
max time kernel
47s -
max time network
12s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
29/06/2022, 12:58
Static task
static1
Behavioral task
behavioral1
Sample
enc.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
enc.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
enc.exe
-
Size
7.7MB
-
MD5
a7ab0969bf6641cd0c7228ae95f6d217
-
SHA1
002971b6d178698bf7930b5b89c201750d80a07e
-
SHA256
117fc30c25b1f28cd923b530ab9f91a0a818925b0b89b8bc9a7f820a9e630464
-
SHA512
7e1cce428e3b80b60635c354801af6e86354c9437ba7a661ca6a922c17057a16439a97d1ea11873eb359c05018df9eb6040b72fa97b30cf4d04cae56bf052b8a
Score
9/10
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*aster = "C:\\Users\\Public\\enc.exe" enc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1156 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe 2040 enc.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2040 enc.exe Token: SeBackupPrivilege 280 vssvc.exe Token: SeRestorePrivilege 280 vssvc.exe Token: SeAuditPrivilege 280 vssvc.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2040 wrote to memory of 1748 2040 enc.exe 32 PID 2040 wrote to memory of 1748 2040 enc.exe 32 PID 2040 wrote to memory of 1748 2040 enc.exe 32 PID 1748 wrote to memory of 1156 1748 cmd.exe 34 PID 1748 wrote to memory of 1156 1748 cmd.exe 34 PID 1748 wrote to memory of 1156 1748 cmd.exe 34 PID 2040 wrote to memory of 804 2040 enc.exe 23
Processes
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted1⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\enc.exe"C:\Users\Admin\AppData\Local\Temp\enc.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1156
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:280