0e2e74e717b7e047a62dad53cafe31eb26f481086507c7ce2e95ad1bb66db7bb

General

Target

Info.Pdf____________________________________________________________.exe
Size

470KB
MD5

1325ea7384a4653a3a337381cfe180fa
SHA1

eb2eae4cc2a5c7356b4e00c0f3d44788c4ae27e0
SHA256

2c6e410c276a53ad9c2f0560604a42bcd487e0d853b6f524b6db278ca112b81d
SHA512

dcaae00a97123d7d97773bdb52f99ea79c20f8a39a5366195c8fa916c7111f69117a91f259fef0ec7d6f67b7e69f734cfe7058c14696aef94ef4fcd1a0378b3d
SSDEEP

6144:eicL4qwxpzEuqcQM8sKndGxkL/Pu4tmB+K/mcm8aST97BX2Lc9i:enUlbzbuxW4uKmEK/mc+m97BWcw

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ejysifbv = "C:\\Windows\\owuruzan.exe"	explorer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Info.Pdf____________________________________________________________.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Info.Pdf____________________________________________________________.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

Info.Pdf____________________________________________________________.exeInfo.Pdf____________________________________________________________.exe

description	pid	process	target process
PID 1120 set thread context of 2040	1120	Info.Pdf____________________________________________________________.exe	Info.Pdf____________________________________________________________.exe
PID 2040 set thread context of 1176	2040	Info.Pdf____________________________________________________________.exe	explorer.exe

Drops file in Windows directory 2 IoCs

Processes:

explorer.exe

description ioc process

File opened for modification C:\Windows\owuruzan.exe explorer.exe
File created C:\Windows\owuruzan.exe explorer.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1868 vssadmin.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 1220 vssvc.exe
Token: SeRestorePrivilege 1220 vssvc.exe
Token: SeAuditPrivilege 1220 vssvc.exe

description	ioc	process
File opened for modification	C:\Windows\owuruzan.exe	explorer.exe
File created	C:\Windows\owuruzan.exe	explorer.exe

pid	process
1868	vssadmin.exe

description	pid	process
Token: SeBackupPrivilege	1220	vssvc.exe
Token: SeRestorePrivilege	1220	vssvc.exe
Token: SeAuditPrivilege	1220	vssvc.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

Info.Pdf____________________________________________________________.exeInfo.Pdf____________________________________________________________.exeexplorer.exe

description	pid	process	target process
PID 1120 wrote to memory of 2040	1120	Info.Pdf____________________________________________________________.exe	Info.Pdf____________________________________________________________.exe
PID 1120 wrote to memory of 2040	1120	Info.Pdf____________________________________________________________.exe	Info.Pdf____________________________________________________________.exe
PID 1120 wrote to memory of 2040	1120	Info.Pdf____________________________________________________________.exe	Info.Pdf____________________________________________________________.exe
PID 1120 wrote to memory of 2040	1120	Info.Pdf____________________________________________________________.exe	Info.Pdf____________________________________________________________.exe
PID 1120 wrote to memory of 2040	1120	Info.Pdf____________________________________________________________.exe	Info.Pdf____________________________________________________________.exe
PID 1120 wrote to memory of 2040	1120	Info.Pdf____________________________________________________________.exe	Info.Pdf____________________________________________________________.exe
PID 1120 wrote to memory of 2040	1120	Info.Pdf____________________________________________________________.exe	Info.Pdf____________________________________________________________.exe
PID 1120 wrote to memory of 2040	1120	Info.Pdf____________________________________________________________.exe	Info.Pdf____________________________________________________________.exe
PID 1120 wrote to memory of 2040	1120	Info.Pdf____________________________________________________________.exe	Info.Pdf____________________________________________________________.exe
PID 1120 wrote to memory of 2040	1120	Info.Pdf____________________________________________________________.exe	Info.Pdf____________________________________________________________.exe
PID 2040 wrote to memory of 1176	2040	Info.Pdf____________________________________________________________.exe	explorer.exe
PID 2040 wrote to memory of 1176	2040	Info.Pdf____________________________________________________________.exe	explorer.exe
PID 2040 wrote to memory of 1176	2040	Info.Pdf____________________________________________________________.exe	explorer.exe
PID 2040 wrote to memory of 1176	2040	Info.Pdf____________________________________________________________.exe	explorer.exe
PID 2040 wrote to memory of 1176	2040	Info.Pdf____________________________________________________________.exe	explorer.exe
PID 1176 wrote to memory of 1868	1176	explorer.exe	vssadmin.exe
PID 1176 wrote to memory of 1868	1176	explorer.exe	vssadmin.exe
PID 1176 wrote to memory of 1868	1176	explorer.exe	vssadmin.exe
PID 1176 wrote to memory of 1868	1176	explorer.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\Info.Pdf____________________________________________________________.exe
"C:\Users\Admin\AppData\Local\Temp\Info.Pdf____________________________________________________________.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1120

C:\Users\Admin\AppData\Local\Temp\Info.Pdf____________________________________________________________.exe
"C:\Users\Admin\AppData\Local\Temp\Info.Pdf____________________________________________________________.exe"
2⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\system32\explorer.exe"
3⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1176

C:\Windows\SysWOW64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
4⤵
- Interacts with shadow copies
PID:1868

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1220

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\itepoqipifegakiz\01000000
Filesize
470KB

MD5
705293f6c34ad86d795f9aaae812d2de

SHA1
57456dfaa59ad6aac9c5ad24c2d8258b8454f574

SHA256
75af1be6f13d86fc21dfab4d47b31410d63f85aacee46cb47426211f21210245

SHA512
4adfc75eb6fa9c5c26c3e4323207ed7da5b96431ce60a890271c45715defe95cc1f79b0868dbb6dc6f5f8f092d8fba8d2c803c5e69ec6c3e28699fd351f613f6

Download Submit
memory/1120-54-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download
memory/1176-70-0x0000000000080000-0x00000000000BC000-memory.dmp

Filesize
240KB

Download
memory/1176-81-0x0000000072501000-0x0000000072503000-memory.dmp

Filesize
8KB

Download
memory/1176-79-0x0000000000080000-0x00000000000BC000-memory.dmp

Filesize
240KB

Download
memory/1176-76-0x0000000074951000-0x0000000074953000-memory.dmp

Filesize
8KB

Download
memory/1176-74-0x000000000009A9D0-mapping.dmp

Download
memory/1176-72-0x0000000000080000-0x00000000000BC000-memory.dmp

Filesize
240KB

Download
memory/1868-80-0x0000000000000000-mapping.dmp

Download
memory/2040-62-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2040-69-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2040-68-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2040-66-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2040-65-0x000000000040B283-mapping.dmp

Download
memory/2040-64-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2040-61-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2040-78-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2040-60-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2040-58-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2040-55-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads