Analysis
-
max time kernel
48s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
21-11-2022 11:49
Static task
static1
Behavioral task
behavioral1
Sample
4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.zip
Resource
win7-20220812-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.zip
Resource
win10v2004-20220812-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe
Resource
win7-20221111-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral4
Sample
4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe
-
Size
156KB
-
MD5
fcd21c6fca3b9378961aa1865bee7ecb
-
SHA1
0abaa05da2a05977e0baf68838cff1712f1789e0
-
SHA256
4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458
-
SHA512
e39c1f965f6faeaa33dfec6eba23fbfff14b287f4777797ea79480bb037d6d806516bda7046315e051961fce12e935ac546819c1e0bef5c33568d68955a9792a
-
SSDEEP
1536:7ZLTzASUIG0TOOYTufIaSWvRYkekdvizSBXxNe9VPw6s6aUCT7Q7qn:OBI9HYyfNBdviGBBQsrhPk4
Score
10/10
Malware Config
Signatures
-
Deletes NTFS Change Journal 2 TTPs 1 IoCs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
pid Process 316 fsutil.exe -
RansomEXX Ransomware
Targeted ransomware with variants which affect Windows and Linux systems.
-
Clears Windows event logs 1 TTPs 4 IoCs
pid Process 1796 wevtutil.exe 2012 wevtutil.exe 836 wevtutil.exe 1568 wevtutil.exe -
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 1164 bcdedit.exe 1560 bcdedit.exe -
pid Process 976 wbadmin.exe -
Disables use of System Restore points 1 TTPs
-
Modifies extensions of user files 14 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ReadUndo.crw => C:\Users\Admin\Pictures\ReadUndo.crw.txd0t 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe File renamed C:\Users\Admin\Pictures\TestSkip.tif => C:\Users\Admin\Pictures\TestSkip.tif.txd0t 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe File renamed C:\Users\Admin\Pictures\ExitClose.png => C:\Users\Admin\Pictures\ExitClose.png.txd0t 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe File opened for modification C:\Users\Admin\Pictures\InvokeSearch.tiff 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe File renamed C:\Users\Admin\Pictures\InvokeSearch.tiff => C:\Users\Admin\Pictures\InvokeSearch.tiff.txd0t 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe File renamed C:\Users\Admin\Pictures\PushInitialize.crw => C:\Users\Admin\Pictures\PushInitialize.crw.txd0t 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe File renamed C:\Users\Admin\Pictures\ConvertFromGet.crw => C:\Users\Admin\Pictures\ConvertFromGet.crw.txd0t 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe File renamed C:\Users\Admin\Pictures\EnableClose.raw => C:\Users\Admin\Pictures\EnableClose.raw.txd0t 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe File opened for modification C:\Users\Admin\Pictures\ResolveEnter.tiff 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe File renamed C:\Users\Admin\Pictures\ResolveEnter.tiff => C:\Users\Admin\Pictures\ResolveEnter.tiff.txd0t 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe File renamed C:\Users\Admin\Pictures\OpenRestore.crw => C:\Users\Admin\Pictures\OpenRestore.crw.txd0t 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe File renamed C:\Users\Admin\Pictures\ReceiveRename.png => C:\Users\Admin\Pictures\ReceiveRename.png.txd0t 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe File renamed C:\Users\Admin\Pictures\SuspendGrant.raw => C:\Users\Admin\Pictures\SuspendGrant.raw.txd0t 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe File renamed C:\Users\Admin\Pictures\SyncLimit.png => C:\Users\Admin\Pictures\SyncLimit.png.txd0t 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe -
Overwrites deleted data with Cipher tool 1 TTPs
Cipher is a Windows tool which be used to securely wipe deallocated HDD space, preventing recovery of deleted data.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: cipher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeSecurityPrivilege 836 wevtutil.exe Token: SeBackupPrivilege 836 wevtutil.exe Token: SeSecurityPrivilege 1544 wevtutil.exe Token: SeSecurityPrivilege 1568 wevtutil.exe Token: SeSecurityPrivilege 2012 wevtutil.exe Token: SeBackupPrivilege 1544 wevtutil.exe Token: SeBackupPrivilege 1568 wevtutil.exe Token: SeBackupPrivilege 2012 wevtutil.exe Token: SeBackupPrivilege 1080 wbengine.exe Token: SeRestorePrivilege 1080 wbengine.exe Token: SeSecurityPrivilege 1080 wbengine.exe Token: SeSecurityPrivilege 1796 wevtutil.exe Token: SeBackupPrivilege 1796 wevtutil.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 1304 wrote to memory of 1560 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 51 PID 1304 wrote to memory of 1560 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 51 PID 1304 wrote to memory of 1560 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 51 PID 1304 wrote to memory of 1560 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 51 PID 1304 wrote to memory of 976 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 53 PID 1304 wrote to memory of 976 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 53 PID 1304 wrote to memory of 976 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 53 PID 1304 wrote to memory of 976 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 53 PID 1304 wrote to memory of 316 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 52 PID 1304 wrote to memory of 316 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 52 PID 1304 wrote to memory of 316 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 52 PID 1304 wrote to memory of 316 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 52 PID 1304 wrote to memory of 1568 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 50 PID 1304 wrote to memory of 1568 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 50 PID 1304 wrote to memory of 1568 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 50 PID 1304 wrote to memory of 1568 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 50 PID 1304 wrote to memory of 836 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 48 PID 1304 wrote to memory of 836 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 48 PID 1304 wrote to memory of 836 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 48 PID 1304 wrote to memory of 836 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 48 PID 1304 wrote to memory of 1164 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 32 PID 1304 wrote to memory of 1164 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 32 PID 1304 wrote to memory of 1164 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 32 PID 1304 wrote to memory of 1164 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 32 PID 1304 wrote to memory of 844 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 31 PID 1304 wrote to memory of 844 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 31 PID 1304 wrote to memory of 844 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 31 PID 1304 wrote to memory of 844 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 31 PID 1304 wrote to memory of 1520 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 47 PID 1304 wrote to memory of 1520 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 47 PID 1304 wrote to memory of 1520 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 47 PID 1304 wrote to memory of 1520 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 47 PID 1304 wrote to memory of 1544 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 30 PID 1304 wrote to memory of 1544 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 30 PID 1304 wrote to memory of 1544 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 30 PID 1304 wrote to memory of 1544 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 30 PID 1304 wrote to memory of 1864 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 49 PID 1304 wrote to memory of 1864 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 49 PID 1304 wrote to memory of 1864 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 49 PID 1304 wrote to memory of 1864 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 49 PID 1304 wrote to memory of 1796 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 34 PID 1304 wrote to memory of 1796 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 34 PID 1304 wrote to memory of 1796 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 34 PID 1304 wrote to memory of 1796 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 34 PID 1304 wrote to memory of 2012 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 45 PID 1304 wrote to memory of 2012 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 45 PID 1304 wrote to memory of 2012 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 45 PID 1304 wrote to memory of 2012 1304 4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe"C:\Users\Admin\AppData\Local\Temp\4cae449450c07b7aa74314173c7b00d409eabfe22b86859f3b3acedd66010458.exe"1⤵
- Modifies extensions of user files
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\System32\wevtutil.exe"C:\Windows\System32\wevtutil.exe" sl Security /e:false2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1544
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disable2⤵PID:844
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no2⤵
- Modifies boot configuration data using bcdedit
PID:1164
-
-
C:\Windows\System32\wevtutil.exe"C:\Windows\System32\wevtutil.exe" cl Security2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:1796
-
-
C:\Windows\System32\wevtutil.exe"C:\Windows\System32\wevtutil.exe" cl System2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2012
-
-
C:\Windows\SysWOW64\cipher.exe"C:\Windows\System32\cipher.exe" /w:D:2⤵
- Enumerates connected drives
PID:1520
-
-
C:\Windows\System32\wevtutil.exe"C:\Windows\System32\wevtutil.exe" cl Application2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:836
-
-
C:\Windows\SysWOW64\cipher.exe"C:\Windows\System32\cipher.exe" /w:C:2⤵PID:1864
-
-
C:\Windows\System32\wevtutil.exe"C:\Windows\System32\wevtutil.exe" cl Setup2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:1568
-
-
C:\Windows\System32\bcdedit.exe"C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:1560
-
-
C:\Windows\System32\fsutil.exe"C:\Windows\System32\fsutil.exe" usn deletejournal /D C:2⤵
- Deletes NTFS Change Journal
PID:316
-
-
C:\Windows\System32\wbadmin.exe"C:\Windows\System32\wbadmin.exe" delete catalog -quiet2⤵
- Deletes backup catalog
PID:976
-
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1080
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:304
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1460