Analysis

  • max time kernel
    183s
  • max time network
    233s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    24-11-2022 07:48

General

  • Target

    5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe

  • Size

    244KB

  • MD5

    b725067c7926e8a3268d2fabfcad7b4e

  • SHA1

    2518fb688bec920f49e6b20144dc385866a2a70c

  • SHA256

    5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef

  • SHA512

    41a2631b82f007cfca0e50904ff288995c202583c0da99df94cf840f5f3b8b6cb332e17cd95ce737f4379074e60250932b5c61d39cb37d829003915c538f908c

  • SSDEEP

    6144:zKsiUOlPoYuvIPXCJ7/r32Ay1BJWCTVTAmk:zx8QYuOCp2Ay/dK

Malware Config

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe
    "C:\Users\Admin\AppData\Local\Temp\5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:596
    • C:\Users\Admin\AppData\Local\Temp\5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe
      C:\Users\Admin\AppData\Local\Temp\5a4b59886e1720839a0731967c000e239cddd5220c3a82d54e326e4b3ca78eef.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:888
      • C:\Windows\syswow64\explorer.exe
        "C:\Windows\syswow64\explorer.exe"
        3⤵
        • Drops startup file
        • Adds Run key to start application
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:1220
        • C:\Windows\syswow64\svchost.exe
          -k netsvcs
          4⤵
          • Drops startup file
          • NTFS ADS
          • Suspicious behavior: EnumeratesProcesses
          PID:1268
        • C:\Windows\syswow64\vssadmin.exe
          vssadmin.exe Delete Shadows /All /Quiet
          4⤵
          • Interacts with shadow copies
          PID:1768
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1504

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

File Deletion

2
T1107

Modify Registry

1
T1112

Impact

Inhibit System Recovery

2
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\8855f3d\8855f3d.exe:1
    Filesize

    551KB

    MD5

    30f505fa06a080a392c0b32ea5a59a24

    SHA1

    e6b9914684cd90c7e24a4d91a48cb5c8c71a20c5

    SHA256

    029746aa3914b912871ddf7ee534710841b43a7c5628ae289643dde7ca9db73a

    SHA512

    95ef3f31d8443df317cacb2ec13ab786e1fe2b533fb276bc6e4e76747f9050fd34b5806b4d79f2242588ef21a4cea0a7aeef7fbbd8ba9710a428b4f93208a909

  • C:\Users\Admin\AppData\Roaming\8855f3d.exe:1
    Filesize

    551KB

    MD5

    30f505fa06a080a392c0b32ea5a59a24

    SHA1

    e6b9914684cd90c7e24a4d91a48cb5c8c71a20c5

    SHA256

    029746aa3914b912871ddf7ee534710841b43a7c5628ae289643dde7ca9db73a

    SHA512

    95ef3f31d8443df317cacb2ec13ab786e1fe2b533fb276bc6e4e76747f9050fd34b5806b4d79f2242588ef21a4cea0a7aeef7fbbd8ba9710a428b4f93208a909

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8855f3d.exe:1
    Filesize

    551KB

    MD5

    30f505fa06a080a392c0b32ea5a59a24

    SHA1

    e6b9914684cd90c7e24a4d91a48cb5c8c71a20c5

    SHA256

    029746aa3914b912871ddf7ee534710841b43a7c5628ae289643dde7ca9db73a

    SHA512

    95ef3f31d8443df317cacb2ec13ab786e1fe2b533fb276bc6e4e76747f9050fd34b5806b4d79f2242588ef21a4cea0a7aeef7fbbd8ba9710a428b4f93208a909

  • memory/596-54-0x0000000075701000-0x0000000075703000-memory.dmp
    Filesize

    8KB

  • memory/596-64-0x0000000000610000-0x0000000000614000-memory.dmp
    Filesize

    16KB

  • memory/888-62-0x0000000000400000-0x000000000042C000-memory.dmp
    Filesize

    176KB

  • memory/888-61-0x0000000000400000-0x000000000042C000-memory.dmp
    Filesize

    176KB

  • memory/888-63-0x0000000000418E50-mapping.dmp
  • memory/888-59-0x0000000000400000-0x000000000042C000-memory.dmp
    Filesize

    176KB

  • memory/888-65-0x0000000000250000-0x000000000025C000-memory.dmp
    Filesize

    48KB

  • memory/888-69-0x0000000000400000-0x000000000042C000-memory.dmp
    Filesize

    176KB

  • memory/888-58-0x0000000000400000-0x000000000042C000-memory.dmp
    Filesize

    176KB

  • memory/888-56-0x0000000000400000-0x000000000042C000-memory.dmp
    Filesize

    176KB

  • memory/888-55-0x0000000000400000-0x000000000042C000-memory.dmp
    Filesize

    176KB

  • memory/1220-74-0x00000000746E1000-0x00000000746E3000-memory.dmp
    Filesize

    8KB

  • memory/1220-75-0x0000000000080000-0x00000000000AC000-memory.dmp
    Filesize

    176KB

  • memory/1220-72-0x0000000000000000-mapping.dmp
  • memory/1228-76-0x00000000025A0000-0x00000000025AC000-memory.dmp
    Filesize

    48KB

  • memory/1228-77-0x0000000140000000-0x00000001405E8000-memory.dmp
    Filesize

    5.9MB

  • memory/1228-70-0x00000000025A0000-0x00000000025AC000-memory.dmp
    Filesize

    48KB

  • memory/1228-71-0x0000000140000000-0x00000001405E8000-memory.dmp
    Filesize

    5.9MB

  • memory/1268-82-0x00000000000E0000-0x000000000010C000-memory.dmp
    Filesize

    176KB

  • memory/1268-80-0x00000000000E0000-0x000000000010C000-memory.dmp
    Filesize

    176KB

  • memory/1268-86-0x00000000008C0000-0x000000000094A000-memory.dmp
    Filesize

    552KB

  • memory/1268-87-0x0000000002BA0000-0x0000000002CD7000-memory.dmp
    Filesize

    1.2MB

  • memory/1268-88-0x0000000002CE0000-0x0000000002E48000-memory.dmp
    Filesize

    1.4MB

  • memory/1268-78-0x0000000000000000-mapping.dmp
  • memory/1768-79-0x0000000000000000-mapping.dmp