Analysis
-
max time kernel
152s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
08-11-2022 11:03
Behavioral task
behavioral1
Sample
f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe
Resource
win10v2004-20220901-en
General
-
Target
f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe
-
Size
42KB
-
MD5
5884482db6adca2b8476c395c66805e7
-
SHA1
4c5b8b834d7d9e8b1316a1b8d2e7b9024022d4ce
-
SHA256
f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839
-
SHA512
4e1007fb311c474217b8dfb810d04c2b188deadf56dcd81ee532a48abeb5fc29ff0eae7628cda5aa78f690f46c2370dfb3379e270ee03e83025f7a872f99e52d
-
SSDEEP
768:AO1oR/RVS1RzK4wbs+D/SIJX+ZZ1SQQwZuIOPzDsUky5DuGMKKz0YnW:AXS1FKnDtkuImNNxFKU
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\1628246561\+README-WARNING+.txt
idemitsu122@cyberfear.com
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Processes:
wbadmin.exepid process 928 wbadmin.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1944 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exepid process 1612 f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
vssvc.exewbengine.exeWMIC.exedescription pid process Token: SeBackupPrivilege 1376 vssvc.exe Token: SeRestorePrivilege 1376 vssvc.exe Token: SeAuditPrivilege 1376 vssvc.exe Token: SeBackupPrivilege 1968 wbengine.exe Token: SeRestorePrivilege 1968 wbengine.exe Token: SeSecurityPrivilege 1968 wbengine.exe Token: SeIncreaseQuotaPrivilege 268 WMIC.exe Token: SeSecurityPrivilege 268 WMIC.exe Token: SeTakeOwnershipPrivilege 268 WMIC.exe Token: SeLoadDriverPrivilege 268 WMIC.exe Token: SeSystemProfilePrivilege 268 WMIC.exe Token: SeSystemtimePrivilege 268 WMIC.exe Token: SeProfSingleProcessPrivilege 268 WMIC.exe Token: SeIncBasePriorityPrivilege 268 WMIC.exe Token: SeCreatePagefilePrivilege 268 WMIC.exe Token: SeBackupPrivilege 268 WMIC.exe Token: SeRestorePrivilege 268 WMIC.exe Token: SeShutdownPrivilege 268 WMIC.exe Token: SeDebugPrivilege 268 WMIC.exe Token: SeSystemEnvironmentPrivilege 268 WMIC.exe Token: SeRemoteShutdownPrivilege 268 WMIC.exe Token: SeUndockPrivilege 268 WMIC.exe Token: SeManageVolumePrivilege 268 WMIC.exe Token: 33 268 WMIC.exe Token: 34 268 WMIC.exe Token: 35 268 WMIC.exe Token: SeIncreaseQuotaPrivilege 268 WMIC.exe Token: SeSecurityPrivilege 268 WMIC.exe Token: SeTakeOwnershipPrivilege 268 WMIC.exe Token: SeLoadDriverPrivilege 268 WMIC.exe Token: SeSystemProfilePrivilege 268 WMIC.exe Token: SeSystemtimePrivilege 268 WMIC.exe Token: SeProfSingleProcessPrivilege 268 WMIC.exe Token: SeIncBasePriorityPrivilege 268 WMIC.exe Token: SeCreatePagefilePrivilege 268 WMIC.exe Token: SeBackupPrivilege 268 WMIC.exe Token: SeRestorePrivilege 268 WMIC.exe Token: SeShutdownPrivilege 268 WMIC.exe Token: SeDebugPrivilege 268 WMIC.exe Token: SeSystemEnvironmentPrivilege 268 WMIC.exe Token: SeRemoteShutdownPrivilege 268 WMIC.exe Token: SeUndockPrivilege 268 WMIC.exe Token: SeManageVolumePrivilege 268 WMIC.exe Token: 33 268 WMIC.exe Token: 34 268 WMIC.exe Token: 35 268 WMIC.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.execmd.exedescription pid process target process PID 1612 wrote to memory of 1708 1612 f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe cmd.exe PID 1612 wrote to memory of 1708 1612 f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe cmd.exe PID 1612 wrote to memory of 1708 1612 f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe cmd.exe PID 1612 wrote to memory of 1708 1612 f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe cmd.exe PID 1708 wrote to memory of 1944 1708 cmd.exe vssadmin.exe PID 1708 wrote to memory of 1944 1708 cmd.exe vssadmin.exe PID 1708 wrote to memory of 1944 1708 cmd.exe vssadmin.exe PID 1708 wrote to memory of 928 1708 cmd.exe wbadmin.exe PID 1708 wrote to memory of 928 1708 cmd.exe wbadmin.exe PID 1708 wrote to memory of 928 1708 cmd.exe wbadmin.exe PID 1708 wrote to memory of 268 1708 cmd.exe WMIC.exe PID 1708 wrote to memory of 268 1708 cmd.exe WMIC.exe PID 1708 wrote to memory of 268 1708 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe"C:\Users\Admin\AppData\Local\Temp\f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe"C:\Users\Admin\AppData\Local\Temp\f4e2bab6cb056c8e644e4b8d4dac7cbf2b972d763f396a475e9fb539438de839.exe" n16122⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/268-60-0x0000000000000000-mapping.dmp
-
memory/928-58-0x0000000000000000-mapping.dmp
-
memory/928-59-0x000007FEFBD91000-0x000007FEFBD93000-memory.dmpFilesize
8KB
-
memory/1612-54-0x0000000076681000-0x0000000076683000-memory.dmpFilesize
8KB
-
memory/1708-55-0x0000000000000000-mapping.dmp
-
memory/1944-57-0x0000000000000000-mapping.dmp