Analysis
-
max time kernel
204s -
max time network
212s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 13:00
Static task
static1
Behavioral task
behavioral1
Sample
Invoice.Pdf_____________________________________________________________.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Invoice.Pdf_____________________________________________________________.exe
Resource
win10v2004-20221111-en
General
-
Target
Invoice.Pdf_____________________________________________________________.exe
-
Size
465KB
-
MD5
79ad66c118590b6e114104dea40b1f4c
-
SHA1
e984c551b479b25401269712cc33379e5ca4592a
-
SHA256
83b99d932fc1fcfb0dc382d405c4a646832c33885208fcbe69e9b5436a74502b
-
SHA512
77817354d178d9fe629772b8e412c310b5989678910c350d450da6b0a2df43fcd6974bb70e478dcefc3a48ae4e9adc1c8ba9394b47e7a5291d3d10218865e7a5
-
SSDEEP
6144:9AKLo20Yi4qqavLTmK9uG6SL2LQoYKynkH8ninottN37F7PYrP+y9h:9Ls20YivTmQuKyQoYLnkH8nH9PYrPF
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts explorer.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uvubohoc = "C:\\Windows\\agyriwaz.exe" explorer.exe -
Processes:
Invoice.Pdf_____________________________________________________________.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Invoice.Pdf_____________________________________________________________.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Invoice.Pdf_____________________________________________________________.exeInvoice.Pdf_____________________________________________________________.exedescription pid process target process PID 1776 set thread context of 1968 1776 Invoice.Pdf_____________________________________________________________.exe Invoice.Pdf_____________________________________________________________.exe PID 1968 set thread context of 580 1968 Invoice.Pdf_____________________________________________________________.exe explorer.exe -
Drops file in Windows directory 2 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\Windows\agyriwaz.exe explorer.exe File created C:\Windows\agyriwaz.exe explorer.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1992 vssadmin.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1092 vssvc.exe Token: SeRestorePrivilege 1092 vssvc.exe Token: SeAuditPrivilege 1092 vssvc.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
Invoice.Pdf_____________________________________________________________.exeInvoice.Pdf_____________________________________________________________.exeexplorer.exedescription pid process target process PID 1776 wrote to memory of 1968 1776 Invoice.Pdf_____________________________________________________________.exe Invoice.Pdf_____________________________________________________________.exe PID 1776 wrote to memory of 1968 1776 Invoice.Pdf_____________________________________________________________.exe Invoice.Pdf_____________________________________________________________.exe PID 1776 wrote to memory of 1968 1776 Invoice.Pdf_____________________________________________________________.exe Invoice.Pdf_____________________________________________________________.exe PID 1776 wrote to memory of 1968 1776 Invoice.Pdf_____________________________________________________________.exe Invoice.Pdf_____________________________________________________________.exe PID 1776 wrote to memory of 1968 1776 Invoice.Pdf_____________________________________________________________.exe Invoice.Pdf_____________________________________________________________.exe PID 1776 wrote to memory of 1968 1776 Invoice.Pdf_____________________________________________________________.exe Invoice.Pdf_____________________________________________________________.exe PID 1776 wrote to memory of 1968 1776 Invoice.Pdf_____________________________________________________________.exe Invoice.Pdf_____________________________________________________________.exe PID 1776 wrote to memory of 1968 1776 Invoice.Pdf_____________________________________________________________.exe Invoice.Pdf_____________________________________________________________.exe PID 1776 wrote to memory of 1968 1776 Invoice.Pdf_____________________________________________________________.exe Invoice.Pdf_____________________________________________________________.exe PID 1776 wrote to memory of 1968 1776 Invoice.Pdf_____________________________________________________________.exe Invoice.Pdf_____________________________________________________________.exe PID 1968 wrote to memory of 580 1968 Invoice.Pdf_____________________________________________________________.exe explorer.exe PID 1968 wrote to memory of 580 1968 Invoice.Pdf_____________________________________________________________.exe explorer.exe PID 1968 wrote to memory of 580 1968 Invoice.Pdf_____________________________________________________________.exe explorer.exe PID 1968 wrote to memory of 580 1968 Invoice.Pdf_____________________________________________________________.exe explorer.exe PID 1968 wrote to memory of 580 1968 Invoice.Pdf_____________________________________________________________.exe explorer.exe PID 580 wrote to memory of 1992 580 explorer.exe vssadmin.exe PID 580 wrote to memory of 1992 580 explorer.exe vssadmin.exe PID 580 wrote to memory of 1992 580 explorer.exe vssadmin.exe PID 580 wrote to memory of 1992 580 explorer.exe vssadmin.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Invoice.Pdf_____________________________________________________________.exe"C:\Users\Admin\AppData\Local\Temp\Invoice.Pdf_____________________________________________________________.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Invoice.Pdf_____________________________________________________________.exe"C:\Users\Admin\AppData\Local\Temp\Invoice.Pdf_____________________________________________________________.exe"2⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"3⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- outlook_win_path
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet4⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\oziqemegewypyvuh\01000000Filesize
465KB
MD52885a93a804bafdfee50728b3b01d9d1
SHA145053b299dc3204413764a95a55d0660413a63c3
SHA256d3ba5a8a12488102f13d97debed83578f8480c241d982eeab111133dbb7a1e03
SHA51218a7e040799b7ec2aabd43fc3ca3be065b853a6530ee8bd915db420bb6ca0ad02dfc203bcd625456764235d0dd7b7bcc43a2dae049fa26f8af4be75cdbf3c857
-
memory/580-69-0x0000000000080000-0x00000000000BE000-memory.dmpFilesize
248KB
-
memory/580-80-0x0000000072181000-0x0000000072183000-memory.dmpFilesize
8KB
-
memory/580-78-0x0000000000080000-0x00000000000BE000-memory.dmpFilesize
248KB
-
memory/580-75-0x00000000745D1000-0x00000000745D3000-memory.dmpFilesize
8KB
-
memory/580-73-0x000000000009BE80-mapping.dmp
-
memory/580-71-0x0000000000080000-0x00000000000BE000-memory.dmpFilesize
248KB
-
memory/1776-54-0x0000000075D61000-0x0000000075D63000-memory.dmpFilesize
8KB
-
memory/1968-62-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1968-68-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1968-60-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1968-65-0x000000000040B4D3-mapping.dmp
-
memory/1968-66-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1968-64-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1968-61-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1968-77-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1968-58-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1968-55-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1992-79-0x0000000000000000-mapping.dmp