Analysis
-
max time kernel
104s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
27-10-2022 11:40
General
-
Target
5f9a45c781500fd1d49e60ecc9acdcd6d92288da92f6130c2efe33aa6fcb251b.exe
-
Size
214KB
-
MD5
67bf839781690986652387e088653eaf
-
SHA1
6ddb5bed7a0ec2db6bc35e5240afff230d19ac77
-
SHA256
5f9a45c781500fd1d49e60ecc9acdcd6d92288da92f6130c2efe33aa6fcb251b
-
SHA512
57049761fff07ea7ca46057fe6d434ebbdd9b93a384c00b74bf86626b97a2cfd11a4bee8adc6b6b286954ce9a9cf7bcfa96c5c8bc1e675f77dec8dd3f4b71aa9
-
SSDEEP
6144:MyJE1yd7WHJmcyfjtPWna4DQFu/U3buRKlemZ9DnGAevIhdiFy+:MU/d7WsvBPWa4DQFu/U3buRKlemZ9Dn4
Malware Config
Extracted
C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT
https://tox.chat/download.html
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 36 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f9a45c781500fd1d49e60ecc9acdcd6d92288da92f6130c2efe33aa6fcb251b.exe"C:\Users\Admin\AppData\Local\Temp\5f9a45c781500fd1d49e60ecc9acdcd6d92288da92f6130c2efe33aa6fcb251b.exe"1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\5f9a45c781500fd1d49e60ecc9acdcd6d92288da92f6130c2efe33aa6fcb251b.exe"C:\Users\Admin\AppData\Local\Temp\5f9a45c781500fd1d49e60ecc9acdcd6d92288da92f6130c2efe33aa6fcb251b.exe" -agent 02⤵
- Drops file in Program Files directory
- Drops file in Windows directory
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy ByPass -Command "Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC.exe shadowcopy delete /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet2⤵
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe2⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262B
MD5e6545ccb3660f88529716ed4e647c713
SHA1ecd628f29985599a24c5c1d23083c689917dd74e
SHA256e802bf0c4481bef693d4d1f307aba48301e330d3728dd46a4ec97c4a96b4d4a7
SHA512f745e7d5dd006083234e783dd5dc7fb83043a7d0479ea2a91a2ddbc8c20ca47343516efbd155271768c675a22b32e88febdfe51551ec42dfdb64805c62c3188d
-
Filesize
340KB
MD55b6a5513faa349e06cfbf12a9122ff11
SHA16fef98d2858acb1a25ddfdd64e88046df71a31bb
SHA256fa9a051f3e05c25bd5c55bf119c1cdfaefd6bce726c4cd8759e99f6938918f09
SHA5127f506256cd5693d7392b877c6243fa4ef00cd63785b2a55f0182638feb72d5bf56f443da9f875ec9e472fb56d85dcb1915578ebfcf96b7343af17490b2afa963
-
Filesize
874KB
MD5a59ac1abbf503e1c5f18694033aefe6a
SHA124ec55a722cda6dd5d439300e58ebc7b1b67598a
SHA256d0226e5e477c9b918fefbebac87905cc50fb282771b192e03141010154babab1
SHA512156796d8c6aa8b0cc90c25390d672246b88fa9dba5573df186fd4f16b69a9416d4aed42bf73cbfffb088494bbd214caf9ce1058a31d7f858db8bb4bf98cb939d
-
Filesize
607KB
MD5f1a876cc1b9bd2ab96f8a57f645c3f1d
SHA158b36a2d5590d6dcfcd628f68b18536af74cd6df
SHA256e73aecf73608a86ccf3a54857c3ea6d6df50224b496d674a342fffb7fe20f760
SHA5120677dae6b95fa3f23b059c2bd906fa143f86b5dd27047f1505c5bd0af946f1a57d9e15afe622984220d21b7ebae10e30559198b7f50dde057df8125438aac4cb
-
Filesize
413KB
MD5c6f230ab336b68a6035f8817eaa3a19a
SHA19693f1dba3c5e2a8abd9b7fc0250e758c7de261d
SHA256ad5323bd8382fe40a7f45a35427cd2c1c59889661ba6c49e3875bfba7b026596
SHA512f51caa13e7749fe0d7487fe4f042386d4cc8af18326df1ea8a856fc36984d28e1ec60c3a793aec1b073930552ff0b17a491f14a727b2c5dc9fafdf092a4ce1b5
-
Filesize
365KB
MD5ad883937aa75cb33b2085dd0c9aed3ae
SHA1892a8c18a1b50959df7f971d03b8b2e0e19a5742
SHA256ab1c9e1b64894c215d33e8b0041ba684e25937e8dd14eaed88dfc73bfacb8da2
SHA512e28486158156c972739387a46f4e9855e33fac4643df676a01dc67ba06e33a68b34f2bfe058a1dfec13a450aef46f09b4a5c2d8f2f467c1a397546902cc7e94a
-
Filesize
704KB
MD57985ca88d5ef039fcc56fad184ee217c
SHA15c99044ee6e77d6df6dc4b9b13ad52cef5264388
SHA256990cc17aea918210c91603fda2b194abfd99e28150b41140d4bf77e04f61604a
SHA512e795a7d991ff1440efcc913ac5f6f5710c6a8585a505172769feeeb597f8e68dbebd49250a260f16142290c830666b0ca88fb8b0c6a2b7c0bee8754b14c08283
-
Filesize
777KB
MD51ce3a068ee33d6492b4b7a3c9843b071
SHA186d2a14c1be1238be573887de3b43c4b33046d6d
SHA256fa4d6fa9c1ca6c9ed1a1186143800c81ede36702e2e668bfe13b4b83dab6fd24
SHA51295ff36d42b292b57a923782d479af0e82c9b778fabeedcb8229bec34fea4b25f1eeb3fdc46b069380ad35639a0b917ba19f4688da524304e74f15269ef9da653
-
Filesize
849KB
MD530158bf039860a681cbbf30affe6955a
SHA161d6a8eb68bc57b5d73326c5d61fdbf9df7e4065
SHA2566fb2f889c51a969136cf0840cb204f203e9fe8aede4a0888e7f88943be507bab
SHA5121448489689d0e863acd6f51c2f380852bbd273f9607da82b555cebb0065d4afaaabdc2e1e4d6c24d6ec3fdca0eaf1f7cf73ebeae92576b95cfbd42ab71e84bde
-
Filesize
316KB
MD5bfd75d3cb4ca7262ab1691e1362f83d0
SHA1738f3bc63dac1a154c91afe2468081500b25cd5b
SHA25665e4be3c013ca15b0485848147a43f09183f06cc60c07aaf0d302a0ec58125da
SHA51238959d9b7153fe93e0e18b103c0a496a6e5f76bba478c238987ed38f3a244b67be4541bc9adcd7e7eecc1af7748c3247b56c6f02f0b5f3695324a5cc8e23f601
-
Filesize
486KB
MD56e71081cddd333c2e4ca21ed9456694b
SHA16177edf5a677b3ecf1dbb298ffaa7024b978db83
SHA256425b8b0125b355dea739cfd6cc4b1ba80f862f47e16f50e2d327b33837aa7f22
SHA512be9c08b105f2403d6c6eebe351bffce104c7c87810235326e0c1a692086059b0ea752ef8b04c722ef30733335f14ad687849248499a0a7b0d17abb97df8340cc
-
Filesize
389KB
MD5bba99b26635799caf1dc24f89d00e118
SHA1c82c87a05396cf96319ed36b4ef1473b7da4f527
SHA2566e013ea3cb769e9de02d361ce44ebc8fadf9d6ec89f15dd09fb55e92ad390909
SHA5122ce89e8db8924495b3b2963122dcbcf3d862a54d02192b12379671f8ca094af813b8dfe42191e77bdf4ac67960ac2aa8729715e5df6f58ef3b7286a86b06b28e
-
Filesize
631KB
MD5062f6c429838a834b189c69166f13bea
SHA14c2e5733933cd0a76c1a4c362924661485bd0cda
SHA2564dbfa493964b2b36442c6d54cac3cd3bf1da1fe75dcd6082a02c33eb4a7acd29
SHA5120cb2f854f949982e9d6e058ac737b01054f0a4f661ea2e341e46877afea03607b97356ba89166fca1468074389f9a8d9333acce9bc2bdb886c6581815aeda498
-
Filesize
437KB
MD59fb418c50abc9eafd2c37f8683dad712
SHA1dc615af06030091a2587965cf1fda4b3062b3bc8
SHA256c7e9d5865db6fdee84f061872faa2c7ff025044d157f86dbdbfb54ba3910085d
SHA5122cf3ed0e054afc15bc01e19cb232c02bb33c15d224c064cef30657092af4b2f4f9cfac393acb5f084a11b1a0bc2f57bbe4b902915eca34da1cf768c1adad1ddd
-
Filesize
898KB
MD5f2a85e14761776a201a92ca888ec4846
SHA128e4e83fc85dac01229470d3c30dfb11dbeb4828
SHA2565995d3a4c129b2d99cb5a3cde3a0b2ebb5e97a3c9fd5f851c52597c5835af1aa
SHA512a6b3d3b48663df37afd3562cce6b96505aba853809506c64f8a3015153ad8ddddbbb1592d33ef7f3ea0ad1d189e6fcb24a3b1e040b3a6a01695bc104c08e7b22
-
Filesize
656KB
MD5085c8ae0cf2d200acb79221a9706ec7b
SHA175aa6304b28ecb3b2fbe735f82d275eb3ef7071b
SHA2566c3d861156ff1b2ccc195ffda235ddd4b7b8744ca34ac055629d907dc7c6023e
SHA512f027f4ad8320217d92288519def1a96b9c04d40418bbf959b9219b66447da4676c8bb88c061727cd1fad3556b8615c8ef0dbccf41101f897b07b2e21af88d683
-
Filesize
680KB
MD553299ce66f8f5d1ada18b87b76bd319e
SHA1894a86c6b7bd31062ecd7320b267eaa927a9d039
SHA256927001610cda5e81185adfdedc18f6cb08c23facb61b990fc80f43e4adac5919
SHA512068a58541401d7404c8a23ed04edbd3f952a73638a2fb8b20940aee226f4a28fc529d195adb58207d8d8f6624fb664e122a37f2a1ed83d8de65a3da820281573
-
Filesize
583KB
MD590f461d80deaf4d76607feb11a81a8f4
SHA1f3dac6032cf5251c89b23aaffa8a7a0ba7bea2c4
SHA256dced98328c4f8791b2830669880dcc80c90f302aecf478c71f93215d80ad5024
SHA51230c74b99afb7b9709b05965bc1a56d59975316375cc22bcca88b8c1429636e191617b2210122cc4250e53b1c9119b67b835222f3321d028fdabab1d5bbbb5409
-
Filesize
801KB
MD56d17b6b44f59b9da38b701585b9d5dd8
SHA1ffa81905ee4ab9cc258a61a1bd9805cb2dc50275
SHA2560177370d977a09e81bd7089d68fafb1787d96947e98bd7214caa7343473a4ab6
SHA5129b5a5525b6920fd06a4e717ce64167374f16bc823158539beb4073b762543c8c7fe0df73913f42db07b8c3dd7ff4bb1f526c012f328905b8191ab823d7a232aa
-
Filesize
728KB
MD56b622abf119f6a500e2357522be1c24e
SHA19438eb0ba3890f3aa873cd0bcd5ab82ad606e185
SHA256bf42c990e58c8b4bb3663dffce8f819e1359a5640730e0363f75c1b944d8eaf5
SHA512c9cbac435341a93c76e0e346408c460176e2952f5735a56b553361f8ce9f4fd1c6069cb1c9d7ad6e9ded165a713fac8b38ff911fa758657a5ce70afd5f5f53b0
-
Filesize
510KB
MD5cf3993e8b5be6bf4e815d6ca89a7cf86
SHA182e810e4af88c13bafe1e5d6a01f0d3d7312a8d5
SHA256f527120950b4a833c728ff9fe1f14308875085e0f84b438f5195c53802ec3684
SHA51244883b93b76f7abb41875a1374cef7beb4fc83defecfc7280093796e842c552a9f736bb38ce9a28ef554305c2ab13e2a3aa5b261f67219fa149617a1f51c537e
-
Filesize
1.2MB
MD505318a6f6f48061c97b12fde502d0b6f
SHA1c173123c0d616e689c932c9605fe185703389d72
SHA2569e2984338dc9ed01115c704409caea07a5617820465e314273fcb47a216ef458
SHA512ec5439f4649a5ce3023b6af970c122b45818fb0fee48302ccb3fd1d7148cade4b950081732aba81720651f07e5277055c50ef96c8327989855dc9b81b079f3d1
-
Filesize
825KB
MD574ce4bb013eda10f658bf17517d4d69f
SHA1c92d2bf193ae7eb0597aab228fe7b361350dd491
SHA2560e3a4da411643e22fab66c86f1c9cc8d45c6952f9b51a0efd8c0ee95d5acda03
SHA51274fdc5f2dd62758f6615e8140f56b3cb9d1c4e19a197c8bd66ad369f3cc4284761e7fc4874a6d49004e88a563b20f5b023d0c9bb91cfc597f03b02753d9dc4d4
-
Filesize
462KB
MD51b99cf69dab7fa00166dc34bc8506271
SHA1d7404384956d7f75d4e94ce350b67b93341b9750
SHA256d43ef2a694de4842ea284a06bd79d9fba6bb78800036e033fa18b476021a0350
SHA5121f20a2d9032f6607ba2020c8eed159ce517a1faed53e6d880dbfd59182f62d2ea878a1c7d8c6765229e796042b84a222264c4b1f60f6c66e0e0e73a7e1e3480c
-
Filesize
559KB
MD5aee3b852408c4d50abd39440d8bf0766
SHA1a8d08486d69f9d85debb12a739442565c1b2bf21
SHA256a04a5d26b5ca5c14eff77a678d8660dde01f219a9c909a36fd3fc76e0447759b
SHA512219e4bb126b376cba80a6f3054caa12a2bb91d618243c5875cbc15b7d495cd73e340ae53e09b101ae2740fa58793e7c4bce73c664df995385086c89dd58dff97
-
Filesize
752KB
MD50c1e31cf2ff6bb8c69d0c0431f7fc123
SHA12c490a15f3fdbe41db0652c5ee9602f56b39dc02
SHA256c17df7f7a43240eee34d8a47f483afe5f77fec37d6d8c5f6dd2e9bea95130c42
SHA51284cb4150c6c8d2da269cbfcb9b11c2de886678847008ac4a8bfe60e583171b8f526a38c7e905be9594d21ae3f65e7bc8323990dc1dac5227940ab3dcca2ab336
-
Filesize
534KB
MD59956c452d3c0e05108a1aca34bed3f14
SHA1876374eeea1a4780488cd46acb2d3dce1020b05a
SHA2564d547aec9fd9aa84b85efb1bd808f46b2740140fad29461f6647a4d515ee52d6
SHA512d1e81895bb23497fd0352efd02140cf71a76c2c37329d124e01a65f9fae4ec7add605f89a324fc207b8e90cf93a19f0bcacedf5ca0e8bf26a348de2afe6ebfa2
-
-
-
-
-
-
-
-
-
Filesize
136KB
-
Filesize
5.6MB
-
Filesize
136KB
-
Filesize
104KB
-
Filesize
600KB
-
Filesize
120KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
6.2MB
-
Filesize
216KB
-
-
-
