Analysis
-
max time kernel
225s -
max time network
322s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 04:02
Static task
static1
Behavioral task
behavioral1
Sample
Informe.Pdf _____________________________________________________________.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Informe.Pdf _____________________________________________________________.exe
Resource
win10v2004-20221111-en
General
-
Target
Informe.Pdf _____________________________________________________________.exe
-
Size
531KB
-
MD5
400d4d727950f4d6de451115b8c4cfc1
-
SHA1
e97b06dc654b70c6c117e7b2e91c9916a06e85a4
-
SHA256
ee177b068a2ac964536637fe4f04ff2deed524e981e69f5cceb2e0dd935c3f65
-
SHA512
0d2d90ed3bef2f321629e63e672855ab9d4c3015970b35990147bdc14c87e657ca6c4178402f77f6e0d35ef82ce338c499b634faf928590d4717ef28d535d281
-
SSDEEP
6144:LUv7JBskamattpI16Mu4isYwNMQ9PRKeIXIRTjv1ECkrQUK:AvqNsieIk3v1eUf
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ivoqubiz = "C:\\Windows\\ocigagab.exe" explorer.exe -
Processes:
Informe.Pdf _____________________________________________________________.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Informe.Pdf _____________________________________________________________.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Informe.Pdf _____________________________________________________________.exeInforme.Pdf _____________________________________________________________.exedescription pid process target process PID 896 set thread context of 1188 896 Informe.Pdf _____________________________________________________________.exe Informe.Pdf _____________________________________________________________.exe PID 1188 set thread context of 1172 1188 Informe.Pdf _____________________________________________________________.exe explorer.exe -
Drops file in Windows directory 2 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\Windows\ocigagab.exe explorer.exe File created C:\Windows\ocigagab.exe explorer.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1756 vssadmin.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 864 vssvc.exe Token: SeRestorePrivilege 864 vssvc.exe Token: SeAuditPrivilege 864 vssvc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Informe.Pdf _____________________________________________________________.exepid process 896 Informe.Pdf _____________________________________________________________.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
Informe.Pdf _____________________________________________________________.exeInforme.Pdf _____________________________________________________________.exeexplorer.exedescription pid process target process PID 896 wrote to memory of 1188 896 Informe.Pdf _____________________________________________________________.exe Informe.Pdf _____________________________________________________________.exe PID 896 wrote to memory of 1188 896 Informe.Pdf _____________________________________________________________.exe Informe.Pdf _____________________________________________________________.exe PID 896 wrote to memory of 1188 896 Informe.Pdf _____________________________________________________________.exe Informe.Pdf _____________________________________________________________.exe PID 896 wrote to memory of 1188 896 Informe.Pdf _____________________________________________________________.exe Informe.Pdf _____________________________________________________________.exe PID 896 wrote to memory of 1188 896 Informe.Pdf _____________________________________________________________.exe Informe.Pdf _____________________________________________________________.exe PID 896 wrote to memory of 1188 896 Informe.Pdf _____________________________________________________________.exe Informe.Pdf _____________________________________________________________.exe PID 896 wrote to memory of 1188 896 Informe.Pdf _____________________________________________________________.exe Informe.Pdf _____________________________________________________________.exe PID 896 wrote to memory of 1188 896 Informe.Pdf _____________________________________________________________.exe Informe.Pdf _____________________________________________________________.exe PID 896 wrote to memory of 1188 896 Informe.Pdf _____________________________________________________________.exe Informe.Pdf _____________________________________________________________.exe PID 896 wrote to memory of 1188 896 Informe.Pdf _____________________________________________________________.exe Informe.Pdf _____________________________________________________________.exe PID 896 wrote to memory of 1188 896 Informe.Pdf _____________________________________________________________.exe Informe.Pdf _____________________________________________________________.exe PID 1188 wrote to memory of 1172 1188 Informe.Pdf _____________________________________________________________.exe explorer.exe PID 1188 wrote to memory of 1172 1188 Informe.Pdf _____________________________________________________________.exe explorer.exe PID 1188 wrote to memory of 1172 1188 Informe.Pdf _____________________________________________________________.exe explorer.exe PID 1188 wrote to memory of 1172 1188 Informe.Pdf _____________________________________________________________.exe explorer.exe PID 1188 wrote to memory of 1172 1188 Informe.Pdf _____________________________________________________________.exe explorer.exe PID 1172 wrote to memory of 1756 1172 explorer.exe vssadmin.exe PID 1172 wrote to memory of 1756 1172 explorer.exe vssadmin.exe PID 1172 wrote to memory of 1756 1172 explorer.exe vssadmin.exe PID 1172 wrote to memory of 1756 1172 explorer.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Informe.Pdf _____________________________________________________________.exe"C:\Users\Admin\AppData\Local\Temp\Informe.Pdf _____________________________________________________________.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Informe.Pdf _____________________________________________________________.exe"C:\Users\Admin\AppData\Local\Temp\Informe.Pdf _____________________________________________________________.exe"2⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"3⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet4⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\ewosolyzuhobytal\01000000Filesize
531KB
MD536ad0d6ee950275d288480e24f812bfd
SHA19dd2572045452dcff3bb8062314817b5b57e84b5
SHA256d06e19904d9a5b3873ded58d05d83a9c78789935522f4b3b838d1b5d456f7e0c
SHA51238dfdcc7841edcee3a6f08d78bbe1a1a43954c5f283996d266d9f0d0e2de66ec67e1ac5a5663ef774ba115c86a253af7586677814f7ebfa6eeb43387b2f04390
-
memory/1172-65-0x0000000000099C80-mapping.dmp
-
memory/1172-61-0x0000000000080000-0x00000000000BB000-memory.dmpFilesize
236KB
-
memory/1172-63-0x0000000000080000-0x00000000000BB000-memory.dmpFilesize
236KB
-
memory/1172-67-0x0000000074FC1000-0x0000000074FC3000-memory.dmpFilesize
8KB
-
memory/1172-70-0x0000000000080000-0x00000000000BB000-memory.dmpFilesize
236KB
-
memory/1172-72-0x0000000072A71000-0x0000000072A73000-memory.dmpFilesize
8KB
-
memory/1188-59-0x00000000767C1000-0x00000000767C3000-memory.dmpFilesize
8KB
-
memory/1188-60-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/1188-57-0x000000000040A7BE-mapping.dmp
-
memory/1188-69-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/1188-56-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/1756-71-0x0000000000000000-mapping.dmp