Overview

overview

9

Static

static

ddc016c410...05.exe

windows7-x64

9

ddc016c410...05.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    105s
  • max time network
    106s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    01-11-2022 18:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ddc016c4106eb349e0d219f2ec70ba1428d3bc0e1b6aeb0b9f4a6242169b6605.exe

  • Size

    69KB

  • MD5

    f12d5cb1e1ef0bd2cfb84e5bfe4a374a

  • SHA1

    b2fc939142188430def4d782d0294a2ecb95d522

  • SHA256

    ddc016c4106eb349e0d219f2ec70ba1428d3bc0e1b6aeb0b9f4a6242169b6605

  • SHA512

    60c3e8406d1f91e94d4f5bc9e50cae8cd256fb0a46395b010bab65c359899aa3e359a4417de062aef1656dcf235047cec547f023465dad48bdda392753335eeb

  • SSDEEP

    1536:bLFfx65YA4hsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2Hl:Vfx6yA0srQLOJgY8Zp8LHD4XWaNH71dj

Score
9/10
ransomware

Malware Config

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 9 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops desktop.ini file(s) 39 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ddc016c4106eb349e0d219f2ec70ba1428d3bc0e1b6aeb0b9f4a6242169b6605.exe
    "C:\Users\Admin\AppData\Local\Temp\ddc016c4106eb349e0d219f2ec70ba1428d3bc0e1b6aeb0b9f4a6242169b6605.exe"
    1⤵
    • Modifies extensions of user files
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1600
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1596
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:1284
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 820
      2⤵
      • Program crash
      PID:916
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1776

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-4063495947-34355257-727531523-1000\desktop.ini
    Filesize

    201B

    MD5

    1988dc08a39f268f55d4fba5bfe5d1a6

    SHA1

    3c182d7b11772169a7876e4a2bb4a402aecdfbe8

    SHA256

    ff1d195ddad9e5a42b9d8e947c898d19c8c325a257edbc4723cfa22c4b75feed

    SHA512

    8acf81dc447bfdaadb15018dbcaac8f11eed60cf918f97ffa21c7bc60e53e9b51b4af5f8e0ebecd8ec84b0f0ba684514d86e947f75d6c4ec3ccd4ab164c6b31f

    Download Submit

  • memory/916-58-0x0000000000000000-mapping.dmp

    Download

  • memory/1284-56-0x0000000000000000-mapping.dmp

    Download

  • memory/1596-55-0x0000000000000000-mapping.dmp

    Download

  • memory/1600-54-0x0000000076461000-0x0000000076463000-memory.dmp

    Filesize

    8KB

    Download