Analysis
-
max time kernel
6s -
max time network
6s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-10-2022 08:40
Behavioral task
behavioral1
Sample
7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe
-
Size
35KB
-
MD5
e90699a13fec55e39e444b3f5dfa98ce
-
SHA1
76283d6c1eea982096fa168b138772094c812474
-
SHA256
7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63
-
SHA512
7b721c6b001c9b0c23e86e3f3a53b13cc08985f09b579e7230af695f71feb1f7b6cb348456b24cb102296da84584a8472c39417fc3275566af016ae656e2ed01
-
SSDEEP
768:18kq7NCuaw+84Q4h99vP8jqgbMidbhvJU9nbcuyD7UI:18kq1aww5EjIidbhhU9nouy8
Score
10/10
Malware Config
Signatures
-
Detected Netwalker Ransomware 2 IoCs
Detected unpacked Netwalker executable.
resource yara_rule behavioral2/memory/4912-132-0x0000000000CD0000-0x0000000000CE9000-memory.dmp netwalker_ransomware behavioral2/memory/4912-134-0x0000000000CD0000-0x0000000000CE9000-memory.dmp netwalker_ransomware -
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
resource yara_rule behavioral2/memory/4912-132-0x0000000000CD0000-0x0000000000CE9000-memory.dmp upx behavioral2/memory/4912-134-0x0000000000CD0000-0x0000000000CE9000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\FindUpdate.xsl 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe File opened for modification C:\Program Files\ImportResolve.ttf 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe File opened for modification C:\Program Files\InitializeRegister.html 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe File opened for modification C:\Program Files\InstallAdd.vstx 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 684 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe Token: SeImpersonatePrivilege 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4912 wrote to memory of 684 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 84 PID 4912 wrote to memory of 684 4912 7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe"C:\Users\Admin\AppData\Local\Temp\7bad3bfde268d71c7dfd13c6d62dc607427912e4106cb4247ef26f4c822fab63.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:684
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:3324