1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77

Resubmissions

09-10-2022 16:47

221009-vatn5shdfj 10

03-10-2022 04:16

221003-evv5pshaen 10

30-09-2022 08:08

220930-j1j2vadghr 10

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30-09-2022 08:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
Size

200KB
MD5

7372c9a138bb854972452263abab1dc5
SHA1

ad247b2428fac6d07bdd9628cddaa18004840e6c
SHA256

1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77
SHA512

3c882b3514c6314ebde04d35748464d4aba3eceb567c1b7ee87f4cf565cf192af3195d21151ef024b2fd19f151beb449fbd28105354a71764b46dbfba5fc1184
SSDEEP

3072:dbOTRwYckApvw14pcODvX/kyeAYcWNzs2C3Zm4YvrCtMNX/eTvpdXfabI5F8lbj4:lOsZiKRJWWYj7eTxdH5qlGuqJH

Score

9^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 1 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	\??\c:\users\admin\pictures\InstallPing.tiff	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	\??\c:\users\admin\appdata\roaming\microsoft\word\startup\how_to_decrypt.hta	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Drops desktop.ini file(s) 29 IoCs

description	ioc	Process
File opened for modification	\??\c:\users\admin\links\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\onedrive\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\videos\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\downloads\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\public\desktop\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\internet explorer\quick launch\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\music\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\pictures\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\pictures\saved pictures\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\searches\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\public\documents\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\public\accountpictures\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\$recycle.bin\s-1-5-21-929662420-1054238289-2961194603-1000\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\contacts\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\favorites\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\pictures\camera roll\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\desktop\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\favorites\links\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\public\libraries\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\public\videos\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\public\pictures\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\3d objects\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\documents\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\admin\saved games\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\public\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\public\downloads\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
File opened for modification	\??\c:\users\public\music\desktop.ini	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
544	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
544	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
544	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
544	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5096	WMIC.exe
Token: SeSecurityPrivilege	5096	WMIC.exe
Token: SeTakeOwnershipPrivilege	5096	WMIC.exe
Token: SeLoadDriverPrivilege	5096	WMIC.exe
Token: SeSystemProfilePrivilege	5096	WMIC.exe
Token: SeSystemtimePrivilege	5096	WMIC.exe
Token: SeProfSingleProcessPrivilege	5096	WMIC.exe
Token: SeIncBasePriorityPrivilege	5096	WMIC.exe
Token: SeCreatePagefilePrivilege	5096	WMIC.exe
Token: SeBackupPrivilege	5096	WMIC.exe
Token: SeRestorePrivilege	5096	WMIC.exe
Token: SeShutdownPrivilege	5096	WMIC.exe
Token: SeDebugPrivilege	5096	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5096	WMIC.exe
Token: SeRemoteShutdownPrivilege	5096	WMIC.exe
Token: SeUndockPrivilege	5096	WMIC.exe
Token: SeManageVolumePrivilege	5096	WMIC.exe
Token: 33	5096	WMIC.exe
Token: 34	5096	WMIC.exe
Token: 35	5096	WMIC.exe
Token: 36	5096	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5096	WMIC.exe
Token: SeSecurityPrivilege	5096	WMIC.exe
Token: SeTakeOwnershipPrivilege	5096	WMIC.exe
Token: SeLoadDriverPrivilege	5096	WMIC.exe
Token: SeSystemProfilePrivilege	5096	WMIC.exe
Token: SeSystemtimePrivilege	5096	WMIC.exe
Token: SeProfSingleProcessPrivilege	5096	WMIC.exe
Token: SeIncBasePriorityPrivilege	5096	WMIC.exe
Token: SeCreatePagefilePrivilege	5096	WMIC.exe
Token: SeBackupPrivilege	5096	WMIC.exe
Token: SeRestorePrivilege	5096	WMIC.exe
Token: SeShutdownPrivilege	5096	WMIC.exe
Token: SeDebugPrivilege	5096	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5096	WMIC.exe
Token: SeRemoteShutdownPrivilege	5096	WMIC.exe
Token: SeUndockPrivilege	5096	WMIC.exe
Token: SeManageVolumePrivilege	5096	WMIC.exe
Token: 33	5096	WMIC.exe
Token: 34	5096	WMIC.exe
Token: 35	5096	WMIC.exe
Token: 36	5096	WMIC.exe
Token: SeBackupPrivilege	2392	vssvc.exe
Token: SeRestorePrivilege	2392	vssvc.exe
Token: SeAuditPrivilege	2392	vssvc.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 2464	544	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	93
PID 544 wrote to memory of 2464	544	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	93
PID 544 wrote to memory of 2464	544	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	93
PID 544 wrote to memory of 4824	544	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	96
PID 544 wrote to memory of 4824	544	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	96
PID 544 wrote to memory of 4824	544	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	96
PID 544 wrote to memory of 2008	544	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	98
PID 544 wrote to memory of 2008	544	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	98
PID 544 wrote to memory of 2008	544	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	98
PID 544 wrote to memory of 3632	544	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	100
PID 544 wrote to memory of 3632	544	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	100
PID 544 wrote to memory of 3632	544	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	100
PID 544 wrote to memory of 3100	544	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	101
PID 544 wrote to memory of 3100	544	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	101
PID 544 wrote to memory of 3100	544	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	101
PID 544 wrote to memory of 2000	544	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	104
PID 544 wrote to memory of 2000	544	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	104
PID 544 wrote to memory of 2000	544	1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe	104
PID 3632 wrote to memory of 5096	3632	cmd.exe	106
PID 3632 wrote to memory of 5096	3632	cmd.exe	106
PID 3632 wrote to memory of 5096	3632	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe
"C:\Users\Admin\AppData\Local\Temp\1e8bafd699de6d5987cfb2fdc138ae15422d8377614107348b905dd0f1bf7d77.exe"
1⤵
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:544
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "vssadmin delete shadows /all /quiet"
  2⤵
  PID:2464
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0"
  2⤵
  PID:4824
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "wbadmin DELETE BACKUP -keepVersions:0"
  2⤵
  PID:2008
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "wmic SHADOWCOPY DELETE"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic SHADOWCOPY DELETE
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5096
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "bcdedit /set {default} recoveryenabled No"
  2⤵
  PID:3100
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"
  2⤵
  PID:2000

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2392

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Credential Access

Credentials in Files

T1081

Discovery

Network Service Scanning

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\desktop.ini

Filesize
935B

MD5
d9c7945574c0adae9012669a046542a1

SHA1
ed5a9872d772c7cca6659814cbc5a6485348acad

SHA256
c9ecda7f2042851a87a0e34e501388331ac977a33a9c6cf7abb791b6c04b390c

SHA512
e6699e876d3b4d746e40c45ea29b184a7977ba97c40a9779fb9cf55cbfd4615f42d0b5ea5b616db39df85095b6cd904d45e766bba1ce67e3ed8fcbfcc880a420

Download Submit