4d3d47fe3d88b6cb5c3dc7712b6f0d948b46f9b1dc6b4415a170d71f7943f556

General

Target

Processing.Pdf____________________________________________________________.exe
Size

470KB
MD5

1325ea7384a4653a3a337381cfe180fa
SHA1

eb2eae4cc2a5c7356b4e00c0f3d44788c4ae27e0
SHA256

2c6e410c276a53ad9c2f0560604a42bcd487e0d853b6f524b6db278ca112b81d
SHA512

dcaae00a97123d7d97773bdb52f99ea79c20f8a39a5366195c8fa916c7111f69117a91f259fef0ec7d6f67b7e69f734cfe7058c14696aef94ef4fcd1a0378b3d
SSDEEP

6144:eicL4qwxpzEuqcQM8sKndGxkL/Pu4tmB+K/mcm8aST97BX2Lc9i:enUlbzbuxW4uKmEK/mc+m97BWcw

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\inyfaluz = "C:\\Windows\\yjuguzoc.exe"	explorer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Processing.Pdf____________________________________________________________.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Processing.Pdf____________________________________________________________.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

Processing.Pdf____________________________________________________________.exeProcessing.Pdf____________________________________________________________.exe

description	pid	process	target process
PID 848 set thread context of 1972	848	Processing.Pdf____________________________________________________________.exe	Processing.Pdf____________________________________________________________.exe
PID 1972 set thread context of 1192	1972	Processing.Pdf____________________________________________________________.exe	explorer.exe

Drops file in Windows directory 2 IoCs

Processes:

explorer.exe

description ioc process

File opened for modification C:\Windows\yjuguzoc.exe explorer.exe
File created C:\Windows\yjuguzoc.exe explorer.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1748 vssadmin.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 1768 vssvc.exe
Token: SeRestorePrivilege 1768 vssvc.exe
Token: SeAuditPrivilege 1768 vssvc.exe

description	ioc	process
File opened for modification	C:\Windows\yjuguzoc.exe	explorer.exe
File created	C:\Windows\yjuguzoc.exe	explorer.exe

pid	process
1748	vssadmin.exe

description	pid	process
Token: SeBackupPrivilege	1768	vssvc.exe
Token: SeRestorePrivilege	1768	vssvc.exe
Token: SeAuditPrivilege	1768	vssvc.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

Processing.Pdf____________________________________________________________.exeProcessing.Pdf____________________________________________________________.exeexplorer.exe

description	pid	process	target process
PID 848 wrote to memory of 1972	848	Processing.Pdf____________________________________________________________.exe	Processing.Pdf____________________________________________________________.exe
PID 848 wrote to memory of 1972	848	Processing.Pdf____________________________________________________________.exe	Processing.Pdf____________________________________________________________.exe
PID 848 wrote to memory of 1972	848	Processing.Pdf____________________________________________________________.exe	Processing.Pdf____________________________________________________________.exe
PID 848 wrote to memory of 1972	848	Processing.Pdf____________________________________________________________.exe	Processing.Pdf____________________________________________________________.exe
PID 848 wrote to memory of 1972	848	Processing.Pdf____________________________________________________________.exe	Processing.Pdf____________________________________________________________.exe
PID 848 wrote to memory of 1972	848	Processing.Pdf____________________________________________________________.exe	Processing.Pdf____________________________________________________________.exe
PID 848 wrote to memory of 1972	848	Processing.Pdf____________________________________________________________.exe	Processing.Pdf____________________________________________________________.exe
PID 848 wrote to memory of 1972	848	Processing.Pdf____________________________________________________________.exe	Processing.Pdf____________________________________________________________.exe
PID 848 wrote to memory of 1972	848	Processing.Pdf____________________________________________________________.exe	Processing.Pdf____________________________________________________________.exe
PID 848 wrote to memory of 1972	848	Processing.Pdf____________________________________________________________.exe	Processing.Pdf____________________________________________________________.exe
PID 1972 wrote to memory of 1192	1972	Processing.Pdf____________________________________________________________.exe	explorer.exe
PID 1972 wrote to memory of 1192	1972	Processing.Pdf____________________________________________________________.exe	explorer.exe
PID 1972 wrote to memory of 1192	1972	Processing.Pdf____________________________________________________________.exe	explorer.exe
PID 1972 wrote to memory of 1192	1972	Processing.Pdf____________________________________________________________.exe	explorer.exe
PID 1972 wrote to memory of 1192	1972	Processing.Pdf____________________________________________________________.exe	explorer.exe
PID 1192 wrote to memory of 1748	1192	explorer.exe	vssadmin.exe
PID 1192 wrote to memory of 1748	1192	explorer.exe	vssadmin.exe
PID 1192 wrote to memory of 1748	1192	explorer.exe	vssadmin.exe
PID 1192 wrote to memory of 1748	1192	explorer.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\Processing.Pdf____________________________________________________________.exe
"C:\Users\Admin\AppData\Local\Temp\Processing.Pdf____________________________________________________________.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:848

C:\Users\Admin\AppData\Local\Temp\Processing.Pdf____________________________________________________________.exe
"C:\Users\Admin\AppData\Local\Temp\Processing.Pdf____________________________________________________________.exe"
2⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\system32\explorer.exe"
3⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1192

C:\Windows\SysWOW64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
4⤵
- Interacts with shadow copies
PID:1748

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\itepoqipifegakiz\01000000

Filesize
470KB

MD5
705293f6c34ad86d795f9aaae812d2de

SHA1
57456dfaa59ad6aac9c5ad24c2d8258b8454f574

SHA256
75af1be6f13d86fc21dfab4d47b31410d63f85aacee46cb47426211f21210245

SHA512
4adfc75eb6fa9c5c26c3e4323207ed7da5b96431ce60a890271c45715defe95cc1f79b0868dbb6dc6f5f8f092d8fba8d2c803c5e69ec6c3e28699fd351f613f6

Download Submit
memory/848-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/1192-69-0x0000000000080000-0x00000000000BC000-memory.dmp

Filesize
240KB

Download
memory/1192-71-0x0000000000080000-0x00000000000BC000-memory.dmp

Filesize
240KB

Download
memory/1192-81-0x0000000000080000-0x00000000000BC000-memory.dmp

Filesize
240KB

Download
memory/1192-80-0x0000000072151000-0x0000000072153000-memory.dmp

Filesize
8KB

Download
memory/1192-76-0x0000000074591000-0x0000000074593000-memory.dmp

Filesize
8KB

Download
memory/1192-73-0x000000000009A9D0-mapping.dmp

Download
memory/1748-79-0x0000000000000000-mapping.dmp

Download
memory/1972-65-0x000000000040B283-mapping.dmp

Download
memory/1972-58-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1972-68-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1972-66-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1972-75-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1972-60-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1972-55-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1972-78-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1972-64-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1972-62-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1972-61-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads