Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
17/10/2022, 12:20
Behavioral task
behavioral1
Sample
c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe
- Size 492KB
- Sample221017-phr8dsbhgl
- SHA256 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4
- MD5 5b93fe3d2c36cf6a97d1c084ead52f51
- SHA1 29821721fbb3c5a08ce62d4fa363c13e4a92302a
- SHA512 6644803c06b75dfeb5de538ae136a7e0d4a7e1e2da10c88639b16840cfc8f67c7c989ab2bd3f37e37bce2a223e09251946dc43a1f85e238bd6584f8b3ab2c24b
- SSDEEP 12288:ZfG0jdhRpfWThnjhrHI2OmeIQcRVn0h2++:Q05pWVNYebnr
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification \??\c:\users\admin\pictures\CompleteResolve.tiff c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe - Drops startup file 1 IoCs
description ioc Process File created \??\c:\users\admin\appdata\roaming\microsoft\word\startup\how_to_decrypt.hta c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe - Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1968 WMIC.exe Token: SeSecurityPrivilege 1968 WMIC.exe Token: SeTakeOwnershipPrivilege 1968 WMIC.exe Token: SeLoadDriverPrivilege 1968 WMIC.exe Token: SeSystemProfilePrivilege 1968 WMIC.exe Token: SeSystemtimePrivilege 1968 WMIC.exe Token: SeProfSingleProcessPrivilege 1968 WMIC.exe Token: SeIncBasePriorityPrivilege 1968 WMIC.exe Token: SeCreatePagefilePrivilege 1968 WMIC.exe Token: SeBackupPrivilege 1968 WMIC.exe Token: SeRestorePrivilege 1968 WMIC.exe Token: SeShutdownPrivilege 1968 WMIC.exe Token: SeDebugPrivilege 1968 WMIC.exe Token: SeSystemEnvironmentPrivilege 1968 WMIC.exe Token: SeRemoteShutdownPrivilege 1968 WMIC.exe Token: SeUndockPrivilege 1968 WMIC.exe Token: SeManageVolumePrivilege 1968 WMIC.exe Token: 33 1968 WMIC.exe Token: 34 1968 WMIC.exe Token: 35 1968 WMIC.exe Token: 36 1968 WMIC.exe Token: SeIncreaseQuotaPrivilege 1968 WMIC.exe Token: SeSecurityPrivilege 1968 WMIC.exe Token: SeTakeOwnershipPrivilege 1968 WMIC.exe Token: SeLoadDriverPrivilege 1968 WMIC.exe Token: SeSystemProfilePrivilege 1968 WMIC.exe Token: SeSystemtimePrivilege 1968 WMIC.exe Token: SeProfSingleProcessPrivilege 1968 WMIC.exe Token: SeIncBasePriorityPrivilege 1968 WMIC.exe Token: SeCreatePagefilePrivilege 1968 WMIC.exe Token: SeBackupPrivilege 1968 WMIC.exe Token: SeRestorePrivilege 1968 WMIC.exe Token: SeShutdownPrivilege 1968 WMIC.exe Token: SeDebugPrivilege 1968 WMIC.exe Token: SeSystemEnvironmentPrivilege 1968 WMIC.exe Token: SeRemoteShutdownPrivilege 1968 WMIC.exe Token: SeUndockPrivilege 1968 WMIC.exe Token: SeManageVolumePrivilege 1968 WMIC.exe Token: 33 1968 WMIC.exe Token: 34 1968 WMIC.exe Token: 35 1968 WMIC.exe Token: 36 1968 WMIC.exe Token: SeBackupPrivilege 4064 vssvc.exe Token: SeRestorePrivilege 4064 vssvc.exe Token: SeAuditPrivilege 4064 vssvc.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3420 wrote to memory of 3860 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 85 PID 3420 wrote to memory of 3860 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 85 PID 3420 wrote to memory of 3860 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 85 PID 3420 wrote to memory of 3828 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 87 PID 3420 wrote to memory of 3828 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 87 PID 3420 wrote to memory of 3828 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 87 PID 3420 wrote to memory of 3160 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 89 PID 3420 wrote to memory of 3160 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 89 PID 3420 wrote to memory of 3160 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 89 PID 3420 wrote to memory of 1720 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 91 PID 3420 wrote to memory of 1720 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 91 PID 3420 wrote to memory of 1720 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 91 PID 3420 wrote to memory of 448 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 93 PID 3420 wrote to memory of 448 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 93 PID 3420 wrote to memory of 448 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 93 PID 3420 wrote to memory of 4856 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 95 PID 3420 wrote to memory of 4856 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 95 PID 3420 wrote to memory of 4856 3420 c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe 95 PID 1720 wrote to memory of 1968 1720 cmd.exe 97 PID 1720 wrote to memory of 1968 1720 cmd.exe 97 PID 1720 wrote to memory of 1968 1720 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe"C:\Users\Admin\AppData\Local\Temp\c9c5a0b7482c1f291040d63f1cfc936a14d039fcc0e754d52cd3cb038c4d70e4.exe"1⤵
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "vssadmin delete shadows /all /quiet"2⤵PID:3860
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0"2⤵PID:3828
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "wbadmin DELETE BACKUP -keepVersions:0"2⤵PID:3160
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "wmic SHADOWCOPY DELETE"2⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic SHADOWCOPY DELETE3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1968
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "bcdedit /set {default} recoveryenabled No"2⤵PID:448
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"2⤵PID:4856
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4064