Analysis
-
max time kernel
186s -
max time network
196s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 12:49
Static task
static1
Behavioral task
behavioral1
Sample
Info.Pdf_____________________________________________________________.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Info.Pdf_____________________________________________________________.exe
Resource
win10v2004-20220812-en
General
-
Target
Info.Pdf_____________________________________________________________.exe
-
Size
465KB
-
MD5
79ad66c118590b6e114104dea40b1f4c
-
SHA1
e984c551b479b25401269712cc33379e5ca4592a
-
SHA256
83b99d932fc1fcfb0dc382d405c4a646832c33885208fcbe69e9b5436a74502b
-
SHA512
77817354d178d9fe629772b8e412c310b5989678910c350d450da6b0a2df43fcd6974bb70e478dcefc3a48ae4e9adc1c8ba9394b47e7a5291d3d10218865e7a5
-
SSDEEP
6144:9AKLo20Yi4qqavLTmK9uG6SL2LQoYKynkH8ninottN37F7PYrP+y9h:9Ls20YivTmQuKyQoYLnkH8nH9PYrPF
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts explorer.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\idbwypil = "C:\\Windows\\ysecaqyh.exe" explorer.exe -
Processes:
Info.Pdf_____________________________________________________________.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Info.Pdf_____________________________________________________________.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Info.Pdf_____________________________________________________________.exeInfo.Pdf_____________________________________________________________.exedescription pid process target process PID 1904 set thread context of 1000 1904 Info.Pdf_____________________________________________________________.exe Info.Pdf_____________________________________________________________.exe PID 1000 set thread context of 1716 1000 Info.Pdf_____________________________________________________________.exe explorer.exe -
Drops file in Windows directory 2 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\Windows\ysecaqyh.exe explorer.exe File created C:\Windows\ysecaqyh.exe explorer.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1700 vssadmin.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1412 vssvc.exe Token: SeRestorePrivilege 1412 vssvc.exe Token: SeAuditPrivilege 1412 vssvc.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
Info.Pdf_____________________________________________________________.exeInfo.Pdf_____________________________________________________________.exeexplorer.exedescription pid process target process PID 1904 wrote to memory of 1000 1904 Info.Pdf_____________________________________________________________.exe Info.Pdf_____________________________________________________________.exe PID 1904 wrote to memory of 1000 1904 Info.Pdf_____________________________________________________________.exe Info.Pdf_____________________________________________________________.exe PID 1904 wrote to memory of 1000 1904 Info.Pdf_____________________________________________________________.exe Info.Pdf_____________________________________________________________.exe PID 1904 wrote to memory of 1000 1904 Info.Pdf_____________________________________________________________.exe Info.Pdf_____________________________________________________________.exe PID 1904 wrote to memory of 1000 1904 Info.Pdf_____________________________________________________________.exe Info.Pdf_____________________________________________________________.exe PID 1904 wrote to memory of 1000 1904 Info.Pdf_____________________________________________________________.exe Info.Pdf_____________________________________________________________.exe PID 1904 wrote to memory of 1000 1904 Info.Pdf_____________________________________________________________.exe Info.Pdf_____________________________________________________________.exe PID 1904 wrote to memory of 1000 1904 Info.Pdf_____________________________________________________________.exe Info.Pdf_____________________________________________________________.exe PID 1904 wrote to memory of 1000 1904 Info.Pdf_____________________________________________________________.exe Info.Pdf_____________________________________________________________.exe PID 1904 wrote to memory of 1000 1904 Info.Pdf_____________________________________________________________.exe Info.Pdf_____________________________________________________________.exe PID 1000 wrote to memory of 1716 1000 Info.Pdf_____________________________________________________________.exe explorer.exe PID 1000 wrote to memory of 1716 1000 Info.Pdf_____________________________________________________________.exe explorer.exe PID 1000 wrote to memory of 1716 1000 Info.Pdf_____________________________________________________________.exe explorer.exe PID 1000 wrote to memory of 1716 1000 Info.Pdf_____________________________________________________________.exe explorer.exe PID 1000 wrote to memory of 1716 1000 Info.Pdf_____________________________________________________________.exe explorer.exe PID 1716 wrote to memory of 1700 1716 explorer.exe vssadmin.exe PID 1716 wrote to memory of 1700 1716 explorer.exe vssadmin.exe PID 1716 wrote to memory of 1700 1716 explorer.exe vssadmin.exe PID 1716 wrote to memory of 1700 1716 explorer.exe vssadmin.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Info.Pdf_____________________________________________________________.exe"C:\Users\Admin\AppData\Local\Temp\Info.Pdf_____________________________________________________________.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Info.Pdf_____________________________________________________________.exe"C:\Users\Admin\AppData\Local\Temp\Info.Pdf_____________________________________________________________.exe"2⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"3⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- outlook_win_path
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet4⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\oziqemegewypyvuh\01000000Filesize
465KB
MD52885a93a804bafdfee50728b3b01d9d1
SHA145053b299dc3204413764a95a55d0660413a63c3
SHA256d3ba5a8a12488102f13d97debed83578f8480c241d982eeab111133dbb7a1e03
SHA51218a7e040799b7ec2aabd43fc3ca3be065b853a6530ee8bd915db420bb6ca0ad02dfc203bcd625456764235d0dd7b7bcc43a2dae049fa26f8af4be75cdbf3c857
-
memory/1000-77-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1000-58-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1000-68-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1000-61-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1000-62-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1000-64-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1000-65-0x000000000040B4D3-mapping.dmp
-
memory/1000-66-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1000-60-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1000-55-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1700-78-0x0000000000000000-mapping.dmp
-
memory/1716-73-0x00000000000DBE80-mapping.dmp
-
memory/1716-71-0x00000000000C0000-0x00000000000FE000-memory.dmpFilesize
248KB
-
memory/1716-75-0x00000000755F1000-0x00000000755F3000-memory.dmpFilesize
8KB
-
memory/1716-81-0x00000000000C0000-0x00000000000FE000-memory.dmpFilesize
248KB
-
memory/1716-79-0x00000000000C0000-0x00000000000FE000-memory.dmpFilesize
248KB
-
memory/1716-80-0x00000000730B1000-0x00000000730B3000-memory.dmpFilesize
8KB
-
memory/1716-69-0x00000000000C0000-0x00000000000FE000-memory.dmpFilesize
248KB
-
memory/1904-54-0x0000000076871000-0x0000000076873000-memory.dmpFilesize
8KB