Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 04:45
Static task
static1
Behavioral task
behavioral1
Sample
92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe
Resource
win10v2004-20221111-en
General
-
Target
92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe
-
Size
443KB
-
MD5
206b5136095cb2bcfb902c8ffb218163
-
SHA1
c7c74e59e23e3c5cb38f77de2a60c36f12554f81
-
SHA256
92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c
-
SHA512
815e121fa100825b147893ab70f38bcab29057e90b6081bb7f6675fb28645c7785af2421d4e1cd0c0dadc5649a46c06d6795de0d0232720f870d77ddf1455151
-
SSDEEP
6144:kzxxeLzWoedqagVOh+RY+m2pBvbHQt2ulwWs45N/bvWNqgRe08r:ExeHWowCO23v7S2uj/SNdfa
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts explorer.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ehicajen = "C:\\Windows\\odisimod.exe" explorer.exe -
Processes:
92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exedescription pid process target process PID 540 set thread context of 960 540 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe PID 960 set thread context of 1212 960 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe explorer.exe -
Drops file in Windows directory 2 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\Windows\odisimod.exe explorer.exe File created C:\Windows\odisimod.exe explorer.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1980 vssadmin.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1572 vssvc.exe Token: SeRestorePrivilege 1572 vssvc.exe Token: SeAuditPrivilege 1572 vssvc.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exeexplorer.exedescription pid process target process PID 540 wrote to memory of 960 540 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe PID 540 wrote to memory of 960 540 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe PID 540 wrote to memory of 960 540 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe PID 540 wrote to memory of 960 540 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe PID 540 wrote to memory of 960 540 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe PID 540 wrote to memory of 960 540 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe PID 540 wrote to memory of 960 540 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe PID 540 wrote to memory of 960 540 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe PID 540 wrote to memory of 960 540 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe PID 540 wrote to memory of 960 540 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe PID 540 wrote to memory of 960 540 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe PID 960 wrote to memory of 1212 960 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe explorer.exe PID 960 wrote to memory of 1212 960 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe explorer.exe PID 960 wrote to memory of 1212 960 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe explorer.exe PID 960 wrote to memory of 1212 960 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe explorer.exe PID 960 wrote to memory of 1212 960 92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe explorer.exe PID 1212 wrote to memory of 1980 1212 explorer.exe vssadmin.exe PID 1212 wrote to memory of 1980 1212 explorer.exe vssadmin.exe PID 1212 wrote to memory of 1980 1212 explorer.exe vssadmin.exe PID 1212 wrote to memory of 1980 1212 explorer.exe vssadmin.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe"C:\Users\Admin\AppData\Local\Temp\92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe"C:\Users\Admin\AppData\Local\Temp\92ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c.exe"2⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"3⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:1212 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet4⤵
- Interacts with shadow copies
PID:1980
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1572
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\ikitizukamiforej\01000000Filesize
443KB
MD5206b5136095cb2bcfb902c8ffb218163
SHA1c7c74e59e23e3c5cb38f77de2a60c36f12554f81
SHA25692ab5cdf666127883d3edcec41b40137585eb86d554fa9c10d823c4bd18f9f9c
SHA512815e121fa100825b147893ab70f38bcab29057e90b6081bb7f6675fb28645c7785af2421d4e1cd0c0dadc5649a46c06d6795de0d0232720f870d77ddf1455151
-
memory/540-54-0x0000000076171000-0x0000000076173000-memory.dmpFilesize
8KB
-
memory/960-62-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/960-55-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/960-61-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/960-58-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/960-64-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/960-65-0x000000000040B163-mapping.dmp
-
memory/960-66-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/960-68-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/960-60-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/960-77-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1212-73-0x000000000009B560-mapping.dmp
-
memory/1212-75-0x0000000075251000-0x0000000075253000-memory.dmpFilesize
8KB
-
memory/1212-71-0x0000000000080000-0x00000000000BD000-memory.dmpFilesize
244KB
-
memory/1212-69-0x0000000000080000-0x00000000000BD000-memory.dmpFilesize
244KB
-
memory/1212-79-0x0000000072E11000-0x0000000072E13000-memory.dmpFilesize
8KB
-
memory/1212-80-0x0000000000080000-0x00000000000BD000-memory.dmpFilesize
244KB
-
memory/1212-81-0x0000000000080000-0x00000000000BD000-memory.dmpFilesize
244KB
-
memory/1980-78-0x0000000000000000-mapping.dmp