a432c68d6905cd6bf88058da199726980d29c114fade1b7e4131901fd3474620

General

Target

Invoice.Pdf_____________________________________________________________.exe
Size

465KB
MD5

edf51b7c2507590d697e0899c0cadcb5
SHA1

b59b8c306917ba92c48abba83992e09e9146336c
SHA256

b3913d567ca228ac32cd35b5d6245393d2b2c1d1c40a60edc55ea7a521f96694
SHA512

f584b7b81a0d2f154d3c7534c11cbbc8f4743f57eb69721eedd63ac840368fb0cfefffd02f1bc05639932187c1566c5da1f97c34938dbb5132aa97568e6adfac
SSDEEP

6144:9AKLo20Yi4qqavLoz4cbcJZeCb8Zyf5RmJugB5ejkcWv:9Ls20YivgtQJZeK8ZI5RmsgB5eEv

Score

9^/10

collection evasion persistence ransomware trojan

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	explorer.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	explorer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ozenedin = "C:\\Windows\\ikujaryg.exe"	explorer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Invoice.Pdf_____________________________________________________________.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Invoice.Pdf_____________________________________________________________.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

Invoice.Pdf_____________________________________________________________.exeInvoice.Pdf_____________________________________________________________.exe

description	pid	process	target process
PID 2008 set thread context of 1972	2008	Invoice.Pdf_____________________________________________________________.exe	Invoice.Pdf_____________________________________________________________.exe
PID 1972 set thread context of 460	1972	Invoice.Pdf_____________________________________________________________.exe	explorer.exe

Drops file in Windows directory 2 IoCs

Processes:

explorer.exe

description ioc process

File opened for modification C:\Windows\ikujaryg.exe explorer.exe
File created C:\Windows\ikujaryg.exe explorer.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

308 vssadmin.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 1016 vssvc.exe
Token: SeRestorePrivilege 1016 vssvc.exe
Token: SeAuditPrivilege 1016 vssvc.exe

description	ioc	process
File opened for modification	C:\Windows\ikujaryg.exe	explorer.exe
File created	C:\Windows\ikujaryg.exe	explorer.exe

pid	process
308	vssadmin.exe

description	pid	process
Token: SeBackupPrivilege	1016	vssvc.exe
Token: SeRestorePrivilege	1016	vssvc.exe
Token: SeAuditPrivilege	1016	vssvc.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

Invoice.Pdf_____________________________________________________________.exeInvoice.Pdf_____________________________________________________________.exeexplorer.exe

description	pid	process	target process
PID 2008 wrote to memory of 1972	2008	Invoice.Pdf_____________________________________________________________.exe	Invoice.Pdf_____________________________________________________________.exe
PID 2008 wrote to memory of 1972	2008	Invoice.Pdf_____________________________________________________________.exe	Invoice.Pdf_____________________________________________________________.exe
PID 2008 wrote to memory of 1972	2008	Invoice.Pdf_____________________________________________________________.exe	Invoice.Pdf_____________________________________________________________.exe
PID 2008 wrote to memory of 1972	2008	Invoice.Pdf_____________________________________________________________.exe	Invoice.Pdf_____________________________________________________________.exe
PID 2008 wrote to memory of 1972	2008	Invoice.Pdf_____________________________________________________________.exe	Invoice.Pdf_____________________________________________________________.exe
PID 2008 wrote to memory of 1972	2008	Invoice.Pdf_____________________________________________________________.exe	Invoice.Pdf_____________________________________________________________.exe
PID 2008 wrote to memory of 1972	2008	Invoice.Pdf_____________________________________________________________.exe	Invoice.Pdf_____________________________________________________________.exe
PID 2008 wrote to memory of 1972	2008	Invoice.Pdf_____________________________________________________________.exe	Invoice.Pdf_____________________________________________________________.exe
PID 2008 wrote to memory of 1972	2008	Invoice.Pdf_____________________________________________________________.exe	Invoice.Pdf_____________________________________________________________.exe
PID 2008 wrote to memory of 1972	2008	Invoice.Pdf_____________________________________________________________.exe	Invoice.Pdf_____________________________________________________________.exe
PID 1972 wrote to memory of 460	1972	Invoice.Pdf_____________________________________________________________.exe	explorer.exe
PID 1972 wrote to memory of 460	1972	Invoice.Pdf_____________________________________________________________.exe	explorer.exe
PID 1972 wrote to memory of 460	1972	Invoice.Pdf_____________________________________________________________.exe	explorer.exe
PID 1972 wrote to memory of 460	1972	Invoice.Pdf_____________________________________________________________.exe	explorer.exe
PID 1972 wrote to memory of 460	1972	Invoice.Pdf_____________________________________________________________.exe	explorer.exe
PID 460 wrote to memory of 308	460	explorer.exe	vssadmin.exe
PID 460 wrote to memory of 308	460	explorer.exe	vssadmin.exe
PID 460 wrote to memory of 308	460	explorer.exe	vssadmin.exe
PID 460 wrote to memory of 308	460	explorer.exe	vssadmin.exe

outlook_win_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	explorer.exe

C:\Users\Admin\AppData\Local\Temp\Invoice.Pdf_____________________________________________________________.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice.Pdf_____________________________________________________________.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2008

C:\Users\Admin\AppData\Local\Temp\Invoice.Pdf_____________________________________________________________.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice.Pdf_____________________________________________________________.exe"
2⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\system32\explorer.exe"
3⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:460

C:\Windows\SysWOW64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
4⤵
- Interacts with shadow copies
PID:308

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

2

T1114

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\oziqemegewypyvuh\01000000

Filesize
465KB

MD5
e7b4759019a6208973b6c6a118978c22

SHA1
d4e4c56db71dbe6ec79fcf69e0a5501381662844

SHA256
0787dad5407590617dc6547658eb977962c5a7101b9a48a5bb11f5e5e8d70a27

SHA512
9c30d3ce5c6b25536ba3f127b5bb16bf65a84c051175fda9d87acfeac7760c543918e26229a53d8b77b99f5307b33f31f2a66a2c1d52d2633005c0b965c68abc

Download Submit
memory/308-80-0x0000000000000000-mapping.dmp

Download
memory/460-69-0x0000000000100000-0x000000000013E000-memory.dmp

Filesize
248KB

Download
memory/460-81-0x0000000072E61000-0x0000000072E63000-memory.dmp

Filesize
8KB

Download
memory/460-79-0x0000000000100000-0x000000000013E000-memory.dmp

Filesize
248KB

Download
memory/460-76-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download
memory/460-73-0x000000000011BE80-mapping.dmp

Download
memory/460-71-0x0000000000100000-0x000000000013E000-memory.dmp

Filesize
248KB

Download
memory/1972-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1972-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1972-66-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1972-65-0x000000000040B4D3-mapping.dmp

Download
memory/1972-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1972-74-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1972-78-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1972-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1972-55-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1972-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1972-58-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2008-54-0x00000000760D1000-0x00000000760D3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads