Overview

overview

9

Static

static

ddc016c410...05.exe

windows7-x64

9

ddc016c410...05.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    96s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/11/2022, 18:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    ddc016c4106eb349e0d219f2ec70ba1428d3bc0e1b6aeb0b9f4a6242169b6605.exe

  • Size

    69KB

  • MD5

    f12d5cb1e1ef0bd2cfb84e5bfe4a374a

  • SHA1

    b2fc939142188430def4d782d0294a2ecb95d522

  • SHA256

    ddc016c4106eb349e0d219f2ec70ba1428d3bc0e1b6aeb0b9f4a6242169b6605

  • SHA512

    60c3e8406d1f91e94d4f5bc9e50cae8cd256fb0a46395b010bab65c359899aa3e359a4417de062aef1656dcf235047cec547f023465dad48bdda392753335eeb

  • SSDEEP

    1536:bLFfx65YA4hsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2Hl:Vfx6yA0srQLOJgY8Zp8LHD4XWaNH71dj

Score
9/10
ransomware

Malware Config

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 14 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s) 29 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ddc016c4106eb349e0d219f2ec70ba1428d3bc0e1b6aeb0b9f4a6242169b6605.exe
    "C:\Users\Admin\AppData\Local\Temp\ddc016c4106eb349e0d219f2ec70ba1428d3bc0e1b6aeb0b9f4a6242169b6605.exe"
    1⤵
    • Modifies extensions of user files
    • Checks computer location settings
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4752
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1204
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:4776
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3624
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:1984
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2012

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\desktop.ini
          Filesize

          201B

          MD5

          f920d1a16cf07f383f77d86caf4c214e

          SHA1

          0661d627ac59023e1c0e29b5af7d85e3d5113727

          SHA256

          629db6ced8628973f6ca5bfcb95d67a0431df20dd857210c8758907b1a4ddb82

          SHA512

          f0e47700405e73128f26b61dd3b0822c7cb94ba6b0f24ab0b4ab4c85d8997a0c047aa2c231aac30a1de90256ebf8c2dc96fa980cf6113324f5492e84e089375d

          Download Submit