Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 11:45
Static task
static1
Behavioral task
behavioral1
Sample
9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe
Resource
win10v2004-20220901-en
General
-
Target
9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe
-
Size
277KB
-
MD5
1dec533464e822a43b0a8160b910d910
-
SHA1
6709c297dafa871c54989569779c828a326f26d2
-
SHA256
9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae
-
SHA512
7b1724e1f5e7191e10c60155b3c790e0d6f760049c264d76d6e73eedcc37bb69c883105fbd4cd74fb5c788da0540950ac2871fa126392b2bffab1f5a431ea13a
-
SSDEEP
6144:edTPNP/JvZ3oqXAhD/rqs9SXZ0PE2hWXsQ:epVPxvZ3oqXk9YZ0M3
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 1 IoCs
Processes:
explorer.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bcf8801.exe explorer.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*cf8801 = "C:\\Users\\Admin\\AppData\\Roaming\\bcf8801.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\bcf880 = "C:\\bcf8801\\bcf8801.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*cf880 = "C:\\bcf8801\\bcf8801.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\bcf8801 = "C:\\Users\\Admin\\AppData\\Roaming\\bcf8801.exe" explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exedescription pid process target process PID 1364 set thread context of 820 1364 9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe 9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1220 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exepid process 1364 9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe 1364 9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exeexplorer.exepid process 820 9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe 944 explorer.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1328 vssvc.exe Token: SeRestorePrivilege 1328 vssvc.exe Token: SeAuditPrivilege 1328 vssvc.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exeexplorer.exedescription pid process target process PID 1364 wrote to memory of 820 1364 9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe 9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe PID 1364 wrote to memory of 820 1364 9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe 9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe PID 1364 wrote to memory of 820 1364 9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe 9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe PID 1364 wrote to memory of 820 1364 9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe 9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe PID 1364 wrote to memory of 820 1364 9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe 9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe PID 1364 wrote to memory of 820 1364 9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe 9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe PID 1364 wrote to memory of 820 1364 9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe 9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe PID 1364 wrote to memory of 820 1364 9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe 9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe PID 1364 wrote to memory of 820 1364 9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe 9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe PID 1364 wrote to memory of 820 1364 9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe 9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe PID 820 wrote to memory of 944 820 9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe explorer.exe PID 820 wrote to memory of 944 820 9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe explorer.exe PID 820 wrote to memory of 944 820 9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe explorer.exe PID 820 wrote to memory of 944 820 9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe explorer.exe PID 944 wrote to memory of 764 944 explorer.exe svchost.exe PID 944 wrote to memory of 764 944 explorer.exe svchost.exe PID 944 wrote to memory of 764 944 explorer.exe svchost.exe PID 944 wrote to memory of 764 944 explorer.exe svchost.exe PID 944 wrote to memory of 1220 944 explorer.exe vssadmin.exe PID 944 wrote to memory of 1220 944 explorer.exe vssadmin.exe PID 944 wrote to memory of 1220 944 explorer.exe vssadmin.exe PID 944 wrote to memory of 1220 944 explorer.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe"C:\Users\Admin\AppData\Local\Temp\9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe"C:\Users\Admin\AppData\Local\Temp\9aca721c7aa4e8e01894daabd4feeb2ada9685e75a2b948c6d3c29eafb03b8ae.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\explorer.exe"C:\Windows\syswow64\explorer.exe"3⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\svchost.exe-k netsvcs4⤵
-
C:\Windows\syswow64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet4⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/764-69-0x0000000000000000-mapping.dmp
-
memory/764-73-0x0000000000090000-0x00000000000B0000-memory.dmpFilesize
128KB
-
memory/764-72-0x0000000000090000-0x00000000000B0000-memory.dmpFilesize
128KB
-
memory/820-55-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/820-57-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/820-58-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/820-61-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/820-62-0x00000000004143B0-mapping.dmp
-
memory/820-60-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/820-54-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/820-65-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/944-64-0x0000000000000000-mapping.dmp
-
memory/944-68-0x0000000000310000-0x0000000000330000-memory.dmpFilesize
128KB
-
memory/944-67-0x0000000074D31000-0x0000000074D33000-memory.dmpFilesize
8KB
-
memory/944-66-0x0000000075091000-0x0000000075093000-memory.dmpFilesize
8KB
-
memory/1220-70-0x0000000000000000-mapping.dmp
-
memory/1364-63-0x0000000000230000-0x0000000000240000-memory.dmpFilesize
64KB