0e2e74e717b7e047a62dad53cafe31eb26f481086507c7ce2e95ad1bb66db7bb

General

Target

Info.Pdf____________________________________________________________.exe
Size

470KB
MD5

1325ea7384a4653a3a337381cfe180fa
SHA1

eb2eae4cc2a5c7356b4e00c0f3d44788c4ae27e0
SHA256

2c6e410c276a53ad9c2f0560604a42bcd487e0d853b6f524b6db278ca112b81d
SHA512

dcaae00a97123d7d97773bdb52f99ea79c20f8a39a5366195c8fa916c7111f69117a91f259fef0ec7d6f67b7e69f734cfe7058c14696aef94ef4fcd1a0378b3d
SSDEEP

6144:eicL4qwxpzEuqcQM8sKndGxkL/Pu4tmB+K/mcm8aST97BX2Lc9i:enUlbzbuxW4uKmEK/mc+m97BWcw

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ejysifbv = "C:\\Windows\\owuruzan.exe"	explorer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Info.Pdf____________________________________________________________.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1120 set thread context of 2040	1120	Info.Pdf____________________________________________________________.exe	28
PID 2040 set thread context of 1176	2040	Info.Pdf____________________________________________________________.exe	29

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\owuruzan.exe	explorer.exe
File created	C:\Windows\owuruzan.exe	explorer.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1868	vssadmin.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	1220	vssvc.exe
Token: SeRestorePrivilege	1220	vssvc.exe
Token: SeAuditPrivilege	1220	vssvc.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 2040	1120	Info.Pdf____________________________________________________________.exe	28
PID 1120 wrote to memory of 2040	1120	Info.Pdf____________________________________________________________.exe	28
PID 1120 wrote to memory of 2040	1120	Info.Pdf____________________________________________________________.exe	28
PID 1120 wrote to memory of 2040	1120	Info.Pdf____________________________________________________________.exe	28
PID 1120 wrote to memory of 2040	1120	Info.Pdf____________________________________________________________.exe	28
PID 1120 wrote to memory of 2040	1120	Info.Pdf____________________________________________________________.exe	28
PID 1120 wrote to memory of 2040	1120	Info.Pdf____________________________________________________________.exe	28
PID 1120 wrote to memory of 2040	1120	Info.Pdf____________________________________________________________.exe	28
PID 1120 wrote to memory of 2040	1120	Info.Pdf____________________________________________________________.exe	28
PID 1120 wrote to memory of 2040	1120	Info.Pdf____________________________________________________________.exe	28
PID 2040 wrote to memory of 1176	2040	Info.Pdf____________________________________________________________.exe	29
PID 2040 wrote to memory of 1176	2040	Info.Pdf____________________________________________________________.exe	29
PID 2040 wrote to memory of 1176	2040	Info.Pdf____________________________________________________________.exe	29
PID 2040 wrote to memory of 1176	2040	Info.Pdf____________________________________________________________.exe	29
PID 2040 wrote to memory of 1176	2040	Info.Pdf____________________________________________________________.exe	29
PID 1176 wrote to memory of 1868	1176	explorer.exe	30
PID 1176 wrote to memory of 1868	1176	explorer.exe	30
PID 1176 wrote to memory of 1868	1176	explorer.exe	30
PID 1176 wrote to memory of 1868	1176	explorer.exe	30

C:\Users\Admin\AppData\Local\Temp\Info.Pdf____________________________________________________________.exe
"C:\Users\Admin\AppData\Local\Temp\Info.Pdf____________________________________________________________.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Users\Admin\AppData\Local\Temp\Info.Pdf____________________________________________________________.exe
  "C:\Users\Admin\AppData\Local\Temp\Info.Pdf____________________________________________________________.exe"
  2⤵
  - Checks whether UAC is enabled
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\system32\explorer.exe"
    3⤵
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin.exe Delete Shadows /All /Quiet
      4⤵
      Interacts with shadow copies
      PID:1868

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\itepoqipifegakiz\01000000

Filesize
470KB

MD5
705293f6c34ad86d795f9aaae812d2de

SHA1
57456dfaa59ad6aac9c5ad24c2d8258b8454f574

SHA256
75af1be6f13d86fc21dfab4d47b31410d63f85aacee46cb47426211f21210245

SHA512
4adfc75eb6fa9c5c26c3e4323207ed7da5b96431ce60a890271c45715defe95cc1f79b0868dbb6dc6f5f8f092d8fba8d2c803c5e69ec6c3e28699fd351f613f6

Download Submit
memory/1120-54-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download
memory/1176-70-0x0000000000080000-0x00000000000BC000-memory.dmp

Filesize
240KB

Download
memory/1176-81-0x0000000072501000-0x0000000072503000-memory.dmp

Filesize
8KB

Download
memory/1176-79-0x0000000000080000-0x00000000000BC000-memory.dmp

Filesize
240KB

Download
memory/1176-76-0x0000000074951000-0x0000000074953000-memory.dmp

Filesize
8KB

Download
memory/1176-72-0x0000000000080000-0x00000000000BC000-memory.dmp

Filesize
240KB

Download
memory/2040-62-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2040-69-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2040-68-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2040-66-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2040-64-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2040-61-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2040-78-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2040-60-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2040-58-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2040-55-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing