Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 04:02
Static task
static1
Behavioral task
behavioral1
Sample
Responder.Pdf _____________________________________________________________.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Responder.Pdf _____________________________________________________________.exe
Resource
win10v2004-20221111-en
General
-
Target
Responder.Pdf _____________________________________________________________.exe
-
Size
531KB
-
MD5
400d4d727950f4d6de451115b8c4cfc1
-
SHA1
e97b06dc654b70c6c117e7b2e91c9916a06e85a4
-
SHA256
ee177b068a2ac964536637fe4f04ff2deed524e981e69f5cceb2e0dd935c3f65
-
SHA512
0d2d90ed3bef2f321629e63e672855ab9d4c3015970b35990147bdc14c87e657ca6c4178402f77f6e0d35ef82ce338c499b634faf928590d4717ef28d535d281
-
SSDEEP
6144:LUv7JBskamattpI16Mu4isYwNMQ9PRKeIXIRTjv1ECkrQUK:AvqNsieIk3v1eUf
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erykobah = "C:\\Windows\\elowgzun.exe" explorer.exe -
Processes:
Responder.Pdf _____________________________________________________________.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Responder.Pdf _____________________________________________________________.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Responder.Pdf _____________________________________________________________.exeResponder.Pdf _____________________________________________________________.exedescription pid process target process PID 992 set thread context of 2008 992 Responder.Pdf _____________________________________________________________.exe Responder.Pdf _____________________________________________________________.exe PID 2008 set thread context of 1624 2008 Responder.Pdf _____________________________________________________________.exe explorer.exe -
Drops file in Windows directory 2 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\Windows\elowgzun.exe explorer.exe File created C:\Windows\elowgzun.exe explorer.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 344 vssadmin.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1828 vssvc.exe Token: SeRestorePrivilege 1828 vssvc.exe Token: SeAuditPrivilege 1828 vssvc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Responder.Pdf _____________________________________________________________.exepid process 992 Responder.Pdf _____________________________________________________________.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
Responder.Pdf _____________________________________________________________.exeResponder.Pdf _____________________________________________________________.exeexplorer.exedescription pid process target process PID 992 wrote to memory of 2008 992 Responder.Pdf _____________________________________________________________.exe Responder.Pdf _____________________________________________________________.exe PID 992 wrote to memory of 2008 992 Responder.Pdf _____________________________________________________________.exe Responder.Pdf _____________________________________________________________.exe PID 992 wrote to memory of 2008 992 Responder.Pdf _____________________________________________________________.exe Responder.Pdf _____________________________________________________________.exe PID 992 wrote to memory of 2008 992 Responder.Pdf _____________________________________________________________.exe Responder.Pdf _____________________________________________________________.exe PID 992 wrote to memory of 2008 992 Responder.Pdf _____________________________________________________________.exe Responder.Pdf _____________________________________________________________.exe PID 992 wrote to memory of 2008 992 Responder.Pdf _____________________________________________________________.exe Responder.Pdf _____________________________________________________________.exe PID 992 wrote to memory of 2008 992 Responder.Pdf _____________________________________________________________.exe Responder.Pdf _____________________________________________________________.exe PID 992 wrote to memory of 2008 992 Responder.Pdf _____________________________________________________________.exe Responder.Pdf _____________________________________________________________.exe PID 992 wrote to memory of 2008 992 Responder.Pdf _____________________________________________________________.exe Responder.Pdf _____________________________________________________________.exe PID 992 wrote to memory of 2008 992 Responder.Pdf _____________________________________________________________.exe Responder.Pdf _____________________________________________________________.exe PID 992 wrote to memory of 2008 992 Responder.Pdf _____________________________________________________________.exe Responder.Pdf _____________________________________________________________.exe PID 2008 wrote to memory of 1624 2008 Responder.Pdf _____________________________________________________________.exe explorer.exe PID 2008 wrote to memory of 1624 2008 Responder.Pdf _____________________________________________________________.exe explorer.exe PID 2008 wrote to memory of 1624 2008 Responder.Pdf _____________________________________________________________.exe explorer.exe PID 2008 wrote to memory of 1624 2008 Responder.Pdf _____________________________________________________________.exe explorer.exe PID 2008 wrote to memory of 1624 2008 Responder.Pdf _____________________________________________________________.exe explorer.exe PID 1624 wrote to memory of 344 1624 explorer.exe vssadmin.exe PID 1624 wrote to memory of 344 1624 explorer.exe vssadmin.exe PID 1624 wrote to memory of 344 1624 explorer.exe vssadmin.exe PID 1624 wrote to memory of 344 1624 explorer.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Responder.Pdf _____________________________________________________________.exe"C:\Users\Admin\AppData\Local\Temp\Responder.Pdf _____________________________________________________________.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Responder.Pdf _____________________________________________________________.exe"C:\Users\Admin\AppData\Local\Temp\Responder.Pdf _____________________________________________________________.exe"2⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"3⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet4⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\ewosolyzuhobytal\01000000Filesize
531KB
MD536ad0d6ee950275d288480e24f812bfd
SHA19dd2572045452dcff3bb8062314817b5b57e84b5
SHA256d06e19904d9a5b3873ded58d05d83a9c78789935522f4b3b838d1b5d456f7e0c
SHA51238dfdcc7841edcee3a6f08d78bbe1a1a43954c5f283996d266d9f0d0e2de66ec67e1ac5a5663ef774ba115c86a253af7586677814f7ebfa6eeb43387b2f04390
-
memory/344-70-0x0000000000000000-mapping.dmp
-
memory/1624-72-0x0000000072B11000-0x0000000072B13000-memory.dmpFilesize
8KB
-
memory/1624-71-0x00000000000F0000-0x000000000012B000-memory.dmpFilesize
236KB
-
memory/1624-61-0x00000000000F0000-0x000000000012B000-memory.dmpFilesize
236KB
-
memory/1624-63-0x00000000000F0000-0x000000000012B000-memory.dmpFilesize
236KB
-
memory/1624-65-0x0000000000109C80-mapping.dmp
-
memory/1624-67-0x0000000074F61000-0x0000000074F63000-memory.dmpFilesize
8KB
-
memory/2008-60-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2008-69-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2008-56-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2008-59-0x0000000076561000-0x0000000076563000-memory.dmpFilesize
8KB
-
memory/2008-57-0x000000000040A7BE-mapping.dmp