a79bb0d047313e02d91cfe0a8e1163739da62bdad9fc3a1cc47d3d036bc854bd

General

Target

fatura_809506887.exe
Size

522KB
MD5

2ad4fc835272034a36a96d49f72bc0c4
SHA1

eef08716315b7fd1fa3b530d1ebcb8bd6fb06fd6
SHA256

c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a
SHA512

a38a4c4be25f70055519ca93253d45e4dcd400a59d9799a0e41603feae0569512e52b237f3aa70ab97139190fcf90f7a5c86b23e40ca9daeb46a2d1c0f7c39e7
SSDEEP

6144:N6LMUWDqIa6V/Ab/f+4tD7nROEuaRh8YHR51yC9fa2te5gCpWiaXRYCUWw0sLl:cofDT/U/f+4dnGYxn8T9I2Nll

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\izlwizyj = "C:\\Windows\\ocydiskz.exe"	explorer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

fatura_809506887.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA fatura_809506887.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

fatura_809506887.exe

pid process

564 fatura_809506887.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fatura_809506887.exe

pid	process
564	fatura_809506887.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

fatura_809506887.exefatura_809506887.exe

description	pid	process	target process
PID 564 set thread context of 1800	564	fatura_809506887.exe	fatura_809506887.exe
PID 1800 set thread context of 1352	1800	fatura_809506887.exe	explorer.exe

Drops file in Windows directory 2 IoCs

Processes:

explorer.exe

description ioc process

File opened for modification C:\Windows\ocydiskz.exe explorer.exe
File created C:\Windows\ocydiskz.exe explorer.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

880 vssadmin.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 676 vssvc.exe
Token: SeRestorePrivilege 676 vssvc.exe
Token: SeAuditPrivilege 676 vssvc.exe

description	ioc	process
File opened for modification	C:\Windows\ocydiskz.exe	explorer.exe
File created	C:\Windows\ocydiskz.exe	explorer.exe

pid	process
880	vssadmin.exe

description	pid	process
Token: SeBackupPrivilege	676	vssvc.exe
Token: SeRestorePrivilege	676	vssvc.exe
Token: SeAuditPrivilege	676	vssvc.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

fatura_809506887.exefatura_809506887.exeexplorer.exe

description	pid	process	target process
PID 564 wrote to memory of 1800	564	fatura_809506887.exe	fatura_809506887.exe
PID 564 wrote to memory of 1800	564	fatura_809506887.exe	fatura_809506887.exe
PID 564 wrote to memory of 1800	564	fatura_809506887.exe	fatura_809506887.exe
PID 564 wrote to memory of 1800	564	fatura_809506887.exe	fatura_809506887.exe
PID 564 wrote to memory of 1800	564	fatura_809506887.exe	fatura_809506887.exe
PID 564 wrote to memory of 1800	564	fatura_809506887.exe	fatura_809506887.exe
PID 564 wrote to memory of 1800	564	fatura_809506887.exe	fatura_809506887.exe
PID 564 wrote to memory of 1800	564	fatura_809506887.exe	fatura_809506887.exe
PID 564 wrote to memory of 1800	564	fatura_809506887.exe	fatura_809506887.exe
PID 564 wrote to memory of 1800	564	fatura_809506887.exe	fatura_809506887.exe
PID 564 wrote to memory of 1800	564	fatura_809506887.exe	fatura_809506887.exe
PID 1800 wrote to memory of 1352	1800	fatura_809506887.exe	explorer.exe
PID 1800 wrote to memory of 1352	1800	fatura_809506887.exe	explorer.exe
PID 1800 wrote to memory of 1352	1800	fatura_809506887.exe	explorer.exe
PID 1800 wrote to memory of 1352	1800	fatura_809506887.exe	explorer.exe
PID 1800 wrote to memory of 1352	1800	fatura_809506887.exe	explorer.exe
PID 1352 wrote to memory of 880	1352	explorer.exe	vssadmin.exe
PID 1352 wrote to memory of 880	1352	explorer.exe	vssadmin.exe
PID 1352 wrote to memory of 880	1352	explorer.exe	vssadmin.exe
PID 1352 wrote to memory of 880	1352	explorer.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\fatura_809506887.exe
"C:\Users\Admin\AppData\Local\Temp\fatura_809506887.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:564

C:\Users\Admin\AppData\Local\Temp\fatura_809506887.exe
"C:\Users\Admin\AppData\Local\Temp\fatura_809506887.exe"
2⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\system32\explorer.exe"
3⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1352

C:\Windows\SysWOW64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
4⤵
- Interacts with shadow copies
PID:880

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:676

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\enusihizoxobojag\01000000
Filesize
522KB

MD5
329ea77825c956d8e7873d223b304773

SHA1
8d959e53cad1de4938e3d3a6815069fd941ea2a7

SHA256
36e463d7ad76f67a56814e059ca4f146f31e0cba892b52e831237f1fe8487eb6

SHA512
4e0d38983edd7676e66acb9ab6b9659d23da5ea8ba520f11078bb7a7cfa44ad0284a4206b27daae940f4a01f059a9c1194ebc61629723ad5656cb12ad596543f

Download Submit
memory/564-55-0x0000000000400000-0x0000000001298000-memory.dmp

Filesize
14.6MB

Download
memory/564-56-0x0000000000400000-0x0000000001298000-memory.dmp

Filesize
14.6MB

Download
memory/564-54-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download
memory/564-70-0x0000000000400000-0x0000000001298000-memory.dmp

Filesize
14.6MB

Download
memory/880-83-0x0000000000000000-mapping.dmp

Download
memory/1352-73-0x0000000000120000-0x000000000015B000-memory.dmp

Filesize
236KB

Download
memory/1352-84-0x0000000072871000-0x0000000072873000-memory.dmp

Filesize
8KB

Download
memory/1352-82-0x0000000000120000-0x000000000015B000-memory.dmp

Filesize
236KB

Download
memory/1352-79-0x0000000074CD1000-0x0000000074CD3000-memory.dmp

Filesize
8KB

Download
memory/1352-75-0x0000000000120000-0x000000000015B000-memory.dmp

Filesize
236KB

Download
memory/1352-77-0x0000000000139C80-mapping.dmp

Download
memory/1800-57-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1800-72-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1800-71-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1800-68-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1800-67-0x000000000040A78E-mapping.dmp

Download
memory/1800-66-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1800-81-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1800-64-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1800-63-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1800-62-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1800-60-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads