Analysis
- max time kernel
150s - max time network
153s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system - submitted
17/10/2022, 12:20
Behavioral task
behavioral1
Sample
c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe
- Size 492KB
- Sample221017-phr8dsbhgl
- SHA256 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4
- MD5 5b93fe3d2c36cf6a97d1c084ead52f51
- SHA1 29821721fbb3c5a08ce62d4fa363c13e4a92302a
- SHA512 6644803c06b75dfeb5de538ae136a7e0d4a7e1e2da10c88639b16840cfc8f67c7c989ab2bd3f37e37bce2a223e09251946dc43a1f85e238bd6584f8b3ab2c24b
- SSDEEP 12288:ZfG0jdhRpfWThnjhrHI2OmeIQcRVn0h2++:Q05pWVNYebnr
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 564 vssadmin.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2016 WMIC.exe Token: SeSecurityPrivilege 2016 WMIC.exe Token: SeTakeOwnershipPrivilege 2016 WMIC.exe Token: SeLoadDriverPrivilege 2016 WMIC.exe Token: SeSystemProfilePrivilege 2016 WMIC.exe Token: SeSystemtimePrivilege 2016 WMIC.exe Token: SeProfSingleProcessPrivilege 2016 WMIC.exe Token: SeIncBasePriorityPrivilege 2016 WMIC.exe Token: SeCreatePagefilePrivilege 2016 WMIC.exe Token: SeBackupPrivilege 2016 WMIC.exe Token: SeRestorePrivilege 2016 WMIC.exe Token: SeShutdownPrivilege 2016 WMIC.exe Token: SeDebugPrivilege 2016 WMIC.exe Token: SeSystemEnvironmentPrivilege 2016 WMIC.exe Token: SeRemoteShutdownPrivilege 2016 WMIC.exe Token: SeUndockPrivilege 2016 WMIC.exe Token: SeManageVolumePrivilege 2016 WMIC.exe Token: 33 2016 WMIC.exe Token: 34 2016 WMIC.exe Token: 35 2016 WMIC.exe Token: SeBackupPrivilege 1312 vssvc.exe Token: SeRestorePrivilege 1312 vssvc.exe Token: SeAuditPrivilege 1312 vssvc.exe Token: SeIncreaseQuotaPrivilege 2016 WMIC.exe Token: SeSecurityPrivilege 2016 WMIC.exe Token: SeTakeOwnershipPrivilege 2016 WMIC.exe Token: SeLoadDriverPrivilege 2016 WMIC.exe Token: SeSystemProfilePrivilege 2016 WMIC.exe Token: SeSystemtimePrivilege 2016 WMIC.exe Token: SeProfSingleProcessPrivilege 2016 WMIC.exe Token: SeIncBasePriorityPrivilege 2016 WMIC.exe Token: SeCreatePagefilePrivilege 2016 WMIC.exe Token: SeBackupPrivilege 2016 WMIC.exe Token: SeRestorePrivilege 2016 WMIC.exe Token: SeShutdownPrivilege 2016 WMIC.exe Token: SeDebugPrivilege 2016 WMIC.exe Token: SeSystemEnvironmentPrivilege 2016 WMIC.exe Token: SeRemoteShutdownPrivilege 2016 WMIC.exe Token: SeUndockPrivilege 2016 WMIC.exe Token: SeManageVolumePrivilege 2016 WMIC.exe Token: 33 2016 WMIC.exe Token: 34 2016 WMIC.exe Token: 35 2016 WMIC.exe - Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1676 wrote to memory of 992 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 29 PID 1676 wrote to memory of 992 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 29 PID 1676 wrote to memory of 992 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 29 PID 1676 wrote to memory of 992 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 29 PID 1676 wrote to memory of 2004 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 31 PID 1676 wrote to memory of 2004 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 31 PID 1676 wrote to memory of 2004 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 31 PID 1676 wrote to memory of 2004 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 31 PID 1676 wrote to memory of 2000 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 33 PID 1676 wrote to memory of 2000 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 33 PID 1676 wrote to memory of 2000 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 33 PID 1676 wrote to memory of 2000 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 33 PID 1676 wrote to memory of 1372 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 35 PID 1676 wrote to memory of 1372 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 35 PID 1676 wrote to memory of 1372 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 35 PID 1676 wrote to memory of 1372 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 35 PID 1676 wrote to memory of 980 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 38 PID 1676 wrote to memory of 980 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 38 PID 1676 wrote to memory of 980 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 38 PID 1676 wrote to memory of 980 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 38 PID 992 wrote to memory of 564 992 cmd.exe 37 PID 992 wrote to memory of 564 992 cmd.exe 37 PID 992 wrote to memory of 564 992 cmd.exe 37 PID 992 wrote to memory of 564 992 cmd.exe 37 PID 1676 wrote to memory of 908 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 39 PID 1676 wrote to memory of 908 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 39 PID 1676 wrote to memory of 908 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 39 PID 1676 wrote to memory of 908 1676 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 39 PID 1372 wrote to memory of 2016 1372 cmd.exe 42 PID 1372 wrote to memory of 2016 1372 cmd.exe 42 PID 1372 wrote to memory of 2016 1372 cmd.exe 42 PID 1372 wrote to memory of 2016 1372 cmd.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe"C:\Users\Admin\AppData\Local\Temp\c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "vssadmin delete shadows /all /quiet"2⤵
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:564
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0"2⤵PID:2004
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "wbadmin DELETE BACKUP -keepVersions:0"2⤵PID:2000
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "wmic SHADOWCOPY DELETE"2⤵
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic SHADOWCOPY DELETE3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2016
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "bcdedit /set {default} recoveryenabled No"2⤵PID:980
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"2⤵PID:908
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1312