18847481617919def623838bdc4b92bab61eefa48240bb75d9524a386116f261

General

Target

18847481617919def623838bdc4b92bab61eefa48240bb75d9524a386116f261.exe
Size

342KB
MD5

a3b398f475ab038fb838f5f8e54d7faf
SHA1

de81525eeb94f703a53955eb990223014c9186e0
SHA256

18847481617919def623838bdc4b92bab61eefa48240bb75d9524a386116f261
SHA512

f22a35996d6cfb61e2f6077b25f985de58774c803a24e19dccd02d43224355f047bb4e4f61390ee183924d448e74441a4a8b7f013e155b79a7b8ef08fe5749f1
SSDEEP

6144:Oq4zFMa9vCxpkER0GzeIwzGsD68wILpvxOmeaRt4ajFjWCnQH1:OJZMa9axpR0GzeI2D68wILpvxZRZA5

Score

9^/10

persistence ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b0cdbf53.exe	explorer.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\b0cdbf5 = "C:\\b0cdbf53\\b0cdbf53.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*0cdbf5 = "C:\\b0cdbf53\\b0cdbf53.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\b0cdbf53 = "C:\\Users\\Admin\\AppData\\Roaming\\b0cdbf53.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*0cdbf53 = "C:\\Users\\Admin\\AppData\\Roaming\\b0cdbf53.exe"	explorer.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-addr.es
4	myexternalip.com
6	myexternalip.com
65	myexternalip.com

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1728	vssadmin.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1328	18847481617919def623838bdc4b92bab61eefa48240bb75d9524a386116f261.exe
1196	explorer.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	1716	vssvc.exe
Token: SeRestorePrivilege	1716	vssvc.exe
Token: SeAuditPrivilege	1716	vssvc.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 1196	1328	18847481617919def623838bdc4b92bab61eefa48240bb75d9524a386116f261.exe	27
PID 1328 wrote to memory of 1196	1328	18847481617919def623838bdc4b92bab61eefa48240bb75d9524a386116f261.exe	27
PID 1328 wrote to memory of 1196	1328	18847481617919def623838bdc4b92bab61eefa48240bb75d9524a386116f261.exe	27
PID 1328 wrote to memory of 1196	1328	18847481617919def623838bdc4b92bab61eefa48240bb75d9524a386116f261.exe	27
PID 1196 wrote to memory of 812	1196	explorer.exe	28
PID 1196 wrote to memory of 812	1196	explorer.exe	28
PID 1196 wrote to memory of 812	1196	explorer.exe	28
PID 1196 wrote to memory of 812	1196	explorer.exe	28
PID 1196 wrote to memory of 1728	1196	explorer.exe	29
PID 1196 wrote to memory of 1728	1196	explorer.exe	29
PID 1196 wrote to memory of 1728	1196	explorer.exe	29
PID 1196 wrote to memory of 1728	1196	explorer.exe	29

C:\Users\Admin\AppData\Local\Temp\18847481617919def623838bdc4b92bab61eefa48240bb75d9524a386116f261.exe
"C:\Users\Admin\AppData\Local\Temp\18847481617919def623838bdc4b92bab61eefa48240bb75d9524a386116f261.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Windows\syswow64\explorer.exe
  "C:\Windows\syswow64\explorer.exe"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Windows\syswow64\svchost.exe
    -k netsvcs
    3⤵
    PID:812
- - C:\Windows\syswow64\vssadmin.exe
    vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:1728

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/812-59-0x0000000000000000-mapping.dmp

Download
memory/812-62-0x0000000000090000-0x00000000000B5000-memory.dmp

Filesize
148KB

Download
memory/812-63-0x0000000000090000-0x00000000000B5000-memory.dmp

Filesize
148KB

Download
memory/1196-54-0x0000000000000000-mapping.dmp

Download
memory/1196-56-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/1196-57-0x0000000074D41000-0x0000000074D43000-memory.dmp

Filesize
8KB

Download
memory/1196-58-0x0000000000080000-0x00000000000A5000-memory.dmp

Filesize
148KB

Download
memory/1328-55-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1728-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing