Analysis
-
max time kernel
185s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 10:02
Static task
static1
Behavioral task
behavioral1
Sample
c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe
Resource
win10v2004-20220812-en
General
-
Target
c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe
-
Size
522KB
-
MD5
2ad4fc835272034a36a96d49f72bc0c4
-
SHA1
eef08716315b7fd1fa3b530d1ebcb8bd6fb06fd6
-
SHA256
c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a
-
SHA512
a38a4c4be25f70055519ca93253d45e4dcd400a59d9799a0e41603feae0569512e52b237f3aa70ab97139190fcf90f7a5c86b23e40ca9daeb46a2d1c0f7c39e7
-
SSDEEP
6144:N6LMUWDqIa6V/Ab/f+4tD7nROEuaRh8YHR51yC9fa2te5gCpWiaXRYCUWw0sLl:cofDT/U/f+4dnGYxn8T9I2Nll
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywechsil = "C:\\Windows\\ovefytop.exe" explorer.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exepid process 4876 c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exec6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exedescription pid process target process PID 4876 set thread context of 4396 4876 c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe PID 4396 set thread context of 4360 4396 c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe explorer.exe -
Drops file in Windows directory 2 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\Windows\ovefytop.exe explorer.exe File created C:\Windows\ovefytop.exe explorer.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 4660 vssadmin.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1312 vssvc.exe Token: SeRestorePrivilege 1312 vssvc.exe Token: SeAuditPrivilege 1312 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exec6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exeexplorer.exedescription pid process target process PID 4876 wrote to memory of 4396 4876 c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe PID 4876 wrote to memory of 4396 4876 c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe PID 4876 wrote to memory of 4396 4876 c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe PID 4876 wrote to memory of 4396 4876 c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe PID 4876 wrote to memory of 4396 4876 c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe PID 4876 wrote to memory of 4396 4876 c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe PID 4876 wrote to memory of 4396 4876 c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe PID 4876 wrote to memory of 4396 4876 c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe PID 4876 wrote to memory of 4396 4876 c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe PID 4876 wrote to memory of 4396 4876 c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe PID 4396 wrote to memory of 4360 4396 c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe explorer.exe PID 4396 wrote to memory of 4360 4396 c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe explorer.exe PID 4396 wrote to memory of 4360 4396 c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe explorer.exe PID 4396 wrote to memory of 4360 4396 c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe explorer.exe PID 4360 wrote to memory of 4660 4360 explorer.exe vssadmin.exe PID 4360 wrote to memory of 4660 4360 explorer.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe"C:\Users\Admin\AppData\Local\Temp\c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe"C:\Users\Admin\AppData\Local\Temp\c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"3⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet4⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\enusihizoxobojag\01000000Filesize
522KB
MD5329ea77825c956d8e7873d223b304773
SHA18d959e53cad1de4938e3d3a6815069fd941ea2a7
SHA25636e463d7ad76f67a56814e059ca4f146f31e0cba892b52e831237f1fe8487eb6
SHA5124e0d38983edd7676e66acb9ab6b9659d23da5ea8ba520f11078bb7a7cfa44ad0284a4206b27daae940f4a01f059a9c1194ebc61629723ad5656cb12ad596543f
-
memory/4360-141-0x0000000001200000-0x000000000123B000-memory.dmpFilesize
236KB
-
memory/4360-146-0x0000000001200000-0x000000000123B000-memory.dmpFilesize
236KB
-
memory/4360-140-0x0000000000000000-mapping.dmp
-
memory/4396-135-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/4396-136-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/4396-138-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/4396-137-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/4396-134-0x0000000000000000-mapping.dmp
-
memory/4396-144-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/4660-145-0x0000000000000000-mapping.dmp
-
memory/4876-139-0x0000000000400000-0x0000000001298000-memory.dmpFilesize
14.6MB
-
memory/4876-132-0x0000000000400000-0x0000000001298000-memory.dmpFilesize
14.6MB
-
memory/4876-133-0x0000000000400000-0x0000000001298000-memory.dmpFilesize
14.6MB