a79bb0d047313e02d91cfe0a8e1163739da62bdad9fc3a1cc47d3d036bc854bd

General

Target

fatura_809506887.exe
Size

522KB
MD5

2ad4fc835272034a36a96d49f72bc0c4
SHA1

eef08716315b7fd1fa3b530d1ebcb8bd6fb06fd6
SHA256

c6057c4adb6e6265a768b533e075d8353750fa8090b1e00154e3169fe5bc460a
SHA512

a38a4c4be25f70055519ca93253d45e4dcd400a59d9799a0e41603feae0569512e52b237f3aa70ab97139190fcf90f7a5c86b23e40ca9daeb46a2d1c0f7c39e7
SSDEEP

6144:N6LMUWDqIa6V/Ab/f+4tD7nROEuaRh8YHR51yC9fa2te5gCpWiaXRYCUWw0sLl:cofDT/U/f+4dnGYxn8T9I2Nll

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\izlwizyj = "C:\\Windows\\ocydiskz.exe"	explorer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fatura_809506887.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
564	fatura_809506887.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 564 set thread context of 1800	564	fatura_809506887.exe	28
PID 1800 set thread context of 1352	1800	fatura_809506887.exe	29

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ocydiskz.exe	explorer.exe
File created	C:\Windows\ocydiskz.exe	explorer.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
880	vssadmin.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	676	vssvc.exe
Token: SeRestorePrivilege	676	vssvc.exe
Token: SeAuditPrivilege	676	vssvc.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 1800	564	fatura_809506887.exe	28
PID 564 wrote to memory of 1800	564	fatura_809506887.exe	28
PID 564 wrote to memory of 1800	564	fatura_809506887.exe	28
PID 564 wrote to memory of 1800	564	fatura_809506887.exe	28
PID 564 wrote to memory of 1800	564	fatura_809506887.exe	28
PID 564 wrote to memory of 1800	564	fatura_809506887.exe	28
PID 564 wrote to memory of 1800	564	fatura_809506887.exe	28
PID 564 wrote to memory of 1800	564	fatura_809506887.exe	28
PID 564 wrote to memory of 1800	564	fatura_809506887.exe	28
PID 564 wrote to memory of 1800	564	fatura_809506887.exe	28
PID 564 wrote to memory of 1800	564	fatura_809506887.exe	28
PID 1800 wrote to memory of 1352	1800	fatura_809506887.exe	29
PID 1800 wrote to memory of 1352	1800	fatura_809506887.exe	29
PID 1800 wrote to memory of 1352	1800	fatura_809506887.exe	29
PID 1800 wrote to memory of 1352	1800	fatura_809506887.exe	29
PID 1800 wrote to memory of 1352	1800	fatura_809506887.exe	29
PID 1352 wrote to memory of 880	1352	explorer.exe	30
PID 1352 wrote to memory of 880	1352	explorer.exe	30
PID 1352 wrote to memory of 880	1352	explorer.exe	30
PID 1352 wrote to memory of 880	1352	explorer.exe	30

C:\Users\Admin\AppData\Local\Temp\fatura_809506887.exe
"C:\Users\Admin\AppData\Local\Temp\fatura_809506887.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:564
- C:\Users\Admin\AppData\Local\Temp\fatura_809506887.exe
  "C:\Users\Admin\AppData\Local\Temp\fatura_809506887.exe"
  2⤵
  - Checks whether UAC is enabled
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\system32\explorer.exe"
    3⤵
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1352
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin.exe Delete Shadows /All /Quiet
      4⤵
      Interacts with shadow copies
      PID:880

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\enusihizoxobojag\01000000

Filesize
522KB

MD5
329ea77825c956d8e7873d223b304773

SHA1
8d959e53cad1de4938e3d3a6815069fd941ea2a7

SHA256
36e463d7ad76f67a56814e059ca4f146f31e0cba892b52e831237f1fe8487eb6

SHA512
4e0d38983edd7676e66acb9ab6b9659d23da5ea8ba520f11078bb7a7cfa44ad0284a4206b27daae940f4a01f059a9c1194ebc61629723ad5656cb12ad596543f

Download Submit
memory/564-55-0x0000000000400000-0x0000000001298000-memory.dmp

Filesize
14.6MB

Download
memory/564-56-0x0000000000400000-0x0000000001298000-memory.dmp

Filesize
14.6MB

Download
memory/564-54-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download
memory/564-70-0x0000000000400000-0x0000000001298000-memory.dmp

Filesize
14.6MB

Download
memory/1352-73-0x0000000000120000-0x000000000015B000-memory.dmp

Filesize
236KB

Download
memory/1352-84-0x0000000072871000-0x0000000072873000-memory.dmp

Filesize
8KB

Download
memory/1352-82-0x0000000000120000-0x000000000015B000-memory.dmp

Filesize
236KB

Download
memory/1352-79-0x0000000074CD1000-0x0000000074CD3000-memory.dmp

Filesize
8KB

Download
memory/1352-75-0x0000000000120000-0x000000000015B000-memory.dmp

Filesize
236KB

Download
memory/1800-57-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1800-72-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1800-71-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1800-68-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1800-66-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1800-81-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1800-64-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1800-63-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1800-62-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1800-60-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing