1a0b133f8d511e0a78ace8b21056f164199c9e502c6f9013f779a8c2584a2626

General

Target

1a0b133f8d511e0a78ace8b21056f164199c9e502c6f9013f779a8c2584a2626.exe
Size

216KB
MD5

18da21337a68b2edf0abedc4a6cb6b0c
SHA1

a42a59f6a2a778ece6cdf55d58ba58243e06a57c
SHA256

1a0b133f8d511e0a78ace8b21056f164199c9e502c6f9013f779a8c2584a2626
SHA512

60ad568cf5dcf02fc612972d1ff1836af924815c7be7ef106b4d565d81326fb3565ba7fa4e98016385a1f093c4b1a84fae0d4a44b84fcee92c29425dfe435487
SSDEEP

3072:rawhW9eOEtiOOrKOoVfyAvs56z/fBTZ+J/h/GfJYO/SB+NvXY7JMW:rq/BpZooAkYfRZ+J/UR/HvXY

Score

9^/10

ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Drops startup file 1 IoCs

Processes:

explorer.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82b2b9a.exe explorer.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

916 vssadmin.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\82b2b9a.exe	explorer.exe

pid	process
916	vssadmin.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{60143476-B13E-47D3-A90E-DC35EE535B5E}	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{60143476-B13E-47D3-A90E-DC35EE535B5E}\WpadNetworkName = "Network 2"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{60143476-B13E-47D3-A90E-DC35EE535B5E}\WpadDecisionReason = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{60143476-B13E-47D3-A90E-DC35EE535B5E}\fa-a0-1b-4a-da-06	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-a0-1b-4a-da-06\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{60143476-B13E-47D3-A90E-DC35EE535B5E}\WpadDecisionTime = b0a75113e401d901	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f001a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{60143476-B13E-47D3-A90E-DC35EE535B5E}\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-a0-1b-4a-da-06	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-a0-1b-4a-da-06\WpadDecisionTime = b0a75113e401d901	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-a0-1b-4a-da-06\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

1a0b133f8d511e0a78ace8b21056f164199c9e502c6f9013f779a8c2584a2626.exe

pid	process
1984	1a0b133f8d511e0a78ace8b21056f164199c9e502c6f9013f779a8c2584a2626.exe
1984	1a0b133f8d511e0a78ace8b21056f164199c9e502c6f9013f779a8c2584a2626.exe
1984	1a0b133f8d511e0a78ace8b21056f164199c9e502c6f9013f779a8c2584a2626.exe
1984	1a0b133f8d511e0a78ace8b21056f164199c9e502c6f9013f779a8c2584a2626.exe
1984	1a0b133f8d511e0a78ace8b21056f164199c9e502c6f9013f779a8c2584a2626.exe
1984	1a0b133f8d511e0a78ace8b21056f164199c9e502c6f9013f779a8c2584a2626.exe
1984	1a0b133f8d511e0a78ace8b21056f164199c9e502c6f9013f779a8c2584a2626.exe
1984	1a0b133f8d511e0a78ace8b21056f164199c9e502c6f9013f779a8c2584a2626.exe
1984	1a0b133f8d511e0a78ace8b21056f164199c9e502c6f9013f779a8c2584a2626.exe
1984	1a0b133f8d511e0a78ace8b21056f164199c9e502c6f9013f779a8c2584a2626.exe

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

1a0b133f8d511e0a78ace8b21056f164199c9e502c6f9013f779a8c2584a2626.exeexplorer.exe

pid	process
1984	1a0b133f8d511e0a78ace8b21056f164199c9e502c6f9013f779a8c2584a2626.exe
1984	1a0b133f8d511e0a78ace8b21056f164199c9e502c6f9013f779a8c2584a2626.exe
1656	explorer.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

vssvc.exe

description	pid	process
Token: SeBackupPrivilege	1292	vssvc.exe
Token: SeRestorePrivilege	1292	vssvc.exe
Token: SeAuditPrivilege	1292	vssvc.exe
Token: SeShutdownPrivilege	1216

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid process

1216
1216
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

pid process

1216
1216
Suspicious use of UnmapMainImage 1 IoCs

Processes:

1a0b133f8d511e0a78ace8b21056f164199c9e502c6f9013f779a8c2584a2626.exe

pid process

1984 1a0b133f8d511e0a78ace8b21056f164199c9e502c6f9013f779a8c2584a2626.exe

pid	process
1216
1216

pid	process
1216
1216

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

1a0b133f8d511e0a78ace8b21056f164199c9e502c6f9013f779a8c2584a2626.exeexplorer.exe

description	pid	process	target process
PID 1984 wrote to memory of 1656	1984	1a0b133f8d511e0a78ace8b21056f164199c9e502c6f9013f779a8c2584a2626.exe	explorer.exe
PID 1984 wrote to memory of 1656	1984	1a0b133f8d511e0a78ace8b21056f164199c9e502c6f9013f779a8c2584a2626.exe	explorer.exe
PID 1984 wrote to memory of 1656	1984	1a0b133f8d511e0a78ace8b21056f164199c9e502c6f9013f779a8c2584a2626.exe	explorer.exe
PID 1984 wrote to memory of 1656	1984	1a0b133f8d511e0a78ace8b21056f164199c9e502c6f9013f779a8c2584a2626.exe	explorer.exe
PID 1656 wrote to memory of 960	1656	explorer.exe	svchost.exe
PID 1656 wrote to memory of 960	1656	explorer.exe	svchost.exe
PID 1656 wrote to memory of 960	1656	explorer.exe	svchost.exe
PID 1656 wrote to memory of 960	1656	explorer.exe	svchost.exe
PID 1656 wrote to memory of 916	1656	explorer.exe	vssadmin.exe
PID 1656 wrote to memory of 916	1656	explorer.exe	vssadmin.exe
PID 1656 wrote to memory of 916	1656	explorer.exe	vssadmin.exe
PID 1656 wrote to memory of 916	1656	explorer.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\1a0b133f8d511e0a78ace8b21056f164199c9e502c6f9013f779a8c2584a2626.exe
"C:\Users\Admin\AppData\Local\Temp\1a0b133f8d511e0a78ace8b21056f164199c9e502c6f9013f779a8c2584a2626.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\syswow64\explorer.exe
  "C:\Windows\syswow64\explorer.exe"
  2⤵
  - Drops startup file
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Windows\syswow64\svchost.exe
    -k netsvcs
    3⤵
    - Modifies data under HKEY_USERS
    PID:960
- - C:\Windows\syswow64\vssadmin.exe
    vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:916

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1292

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/916-71-0x0000000000000000-mapping.dmp

Download
memory/960-74-0x00000000000E0000-0x000000000010B000-memory.dmp

Filesize
172KB

Download
memory/960-73-0x00000000000E0000-0x000000000010B000-memory.dmp

Filesize
172KB

Download
memory/960-70-0x0000000000000000-mapping.dmp

Download
memory/1216-62-0x0000000001DD0000-0x0000000001DDC000-memory.dmp

Filesize
48KB

Download
memory/1216-63-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1656-68-0x00000000745B1000-0x00000000745B3000-memory.dmp

Filesize
8KB

Download
memory/1656-65-0x0000000000000000-mapping.dmp

Download
memory/1656-69-0x0000000000080000-0x00000000000AB000-memory.dmp

Filesize
172KB

Download
memory/1984-61-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1984-66-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1984-64-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1984-54-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download
memory/1984-57-0x0000000000280000-0x000000000028C000-memory.dmp

Filesize
48KB

Download
memory/1984-55-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads