Analysis
-
max time kernel
181s -
max time network
192s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 09:33
Static task
static1
Behavioral task
behavioral1
Sample
486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe
Resource
win10v2004-20220812-en
General
-
Target
486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe
-
Size
244KB
-
MD5
796fdae3b1476ed20cdac74ca9d40973
-
SHA1
1067f53a9e67a61f41d649874e7c40a1e0a2cb2e
-
SHA256
486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b
-
SHA512
1948b409fa2d680708ca8b839576597d24bd7a90537c7dd07f22c08ce9edd775153d00ace206565bd6012803347c9be253db04206fbb36e85e9b0997a2c39157
-
SSDEEP
6144:AhBgQhoowwzLDmJYIdzNjlIccwO33XdGaSb:Ah2QhpNKJYIdzNjcndGaA
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 2 IoCs
Processes:
explorer.exesvchost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d25fddd.exe explorer.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d25fddd.exe:1 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exedescription pid process target process PID 1376 set thread context of 1568 1376 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 364 vssadmin.exe -
Modifies data under HKEY_USERS 24 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0082000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6FD0FA43-346D-45DF-BB24-889D22D8A3C4}\WpadNetworkName = "Network 3" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-e1-db-ed-d7-fe\WpadDecisionTime = 00895cd1f801d901 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-e1-db-ed-d7-fe\WpadDecision = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6FD0FA43-346D-45DF-BB24-889D22D8A3C4}\WpadDecisionTime = 00895cd1f801d901 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-e1-db-ed-d7-fe svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6FD0FA43-346D-45DF-BB24-889D22D8A3C4}\56-e1-db-ed-d7-fe svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-e1-db-ed-d7-fe\WpadDecisionReason = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6FD0FA43-346D-45DF-BB24-889D22D8A3C4} svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6FD0FA43-346D-45DF-BB24-889D22D8A3C4}\WpadDecisionReason = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6FD0FA43-346D-45DF-BB24-889D22D8A3C4}\WpadDecision = "0" svchost.exe -
NTFS ADS 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\d25fddd.exe:1 svchost.exe File created C:\d25fddd\d25fddd.exe:1 svchost.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exesvchost.exepid process 1376 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe 1376 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe 1376 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe 1568 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe 1568 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe 1568 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe 1568 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe 1568 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe 1568 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe 1568 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe 1568 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe 1568 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe 1568 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe 1568 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe 1568 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe 628 svchost.exe 628 svchost.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exeexplorer.exepid process 1568 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe 1568 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe 672 explorer.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1548 vssvc.exe Token: SeRestorePrivilege 1548 vssvc.exe Token: SeAuditPrivilege 1548 vssvc.exe Token: SeShutdownPrivilege 1380 -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exepid process 1376 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe 1376 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exeexplorer.exedescription pid process target process PID 1376 wrote to memory of 1568 1376 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe PID 1376 wrote to memory of 1568 1376 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe PID 1376 wrote to memory of 1568 1376 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe PID 1376 wrote to memory of 1568 1376 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe PID 1376 wrote to memory of 1568 1376 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe PID 1376 wrote to memory of 1568 1376 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe PID 1376 wrote to memory of 1568 1376 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe PID 1376 wrote to memory of 1568 1376 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe PID 1376 wrote to memory of 1568 1376 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe PID 1376 wrote to memory of 1568 1376 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe PID 1568 wrote to memory of 672 1568 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe explorer.exe PID 1568 wrote to memory of 672 1568 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe explorer.exe PID 1568 wrote to memory of 672 1568 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe explorer.exe PID 1568 wrote to memory of 672 1568 486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe explorer.exe PID 672 wrote to memory of 628 672 explorer.exe svchost.exe PID 672 wrote to memory of 628 672 explorer.exe svchost.exe PID 672 wrote to memory of 628 672 explorer.exe svchost.exe PID 672 wrote to memory of 628 672 explorer.exe svchost.exe PID 672 wrote to memory of 364 672 explorer.exe vssadmin.exe PID 672 wrote to memory of 364 672 explorer.exe vssadmin.exe PID 672 wrote to memory of 364 672 explorer.exe vssadmin.exe PID 672 wrote to memory of 364 672 explorer.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe"C:\Users\Admin\AppData\Local\Temp\486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exeC:\Users\Admin\AppData\Local\Temp\486763428440e24a5ffb2a2b0fb799602c6e73d494efe853b306100555abc69b.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\explorer.exe"C:\Windows\syswow64\explorer.exe"3⤵
- Drops startup file
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\svchost.exe-k netsvcs4⤵
- Drops startup file
- Modifies data under HKEY_USERS
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\syswow64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet4⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d25fddd.exe:1Filesize
551KB
MD530f505fa06a080a392c0b32ea5a59a24
SHA1e6b9914684cd90c7e24a4d91a48cb5c8c71a20c5
SHA256029746aa3914b912871ddf7ee534710841b43a7c5628ae289643dde7ca9db73a
SHA51295ef3f31d8443df317cacb2ec13ab786e1fe2b533fb276bc6e4e76747f9050fd34b5806b4d79f2242588ef21a4cea0a7aeef7fbbd8ba9710a428b4f93208a909
-
C:\Users\Admin\AppData\Roaming\d25fddd.exe:1Filesize
551KB
MD530f505fa06a080a392c0b32ea5a59a24
SHA1e6b9914684cd90c7e24a4d91a48cb5c8c71a20c5
SHA256029746aa3914b912871ddf7ee534710841b43a7c5628ae289643dde7ca9db73a
SHA51295ef3f31d8443df317cacb2ec13ab786e1fe2b533fb276bc6e4e76747f9050fd34b5806b4d79f2242588ef21a4cea0a7aeef7fbbd8ba9710a428b4f93208a909
-
C:\d25fddd\d25fddd.exe:1Filesize
551KB
MD530f505fa06a080a392c0b32ea5a59a24
SHA1e6b9914684cd90c7e24a4d91a48cb5c8c71a20c5
SHA256029746aa3914b912871ddf7ee534710841b43a7c5628ae289643dde7ca9db73a
SHA51295ef3f31d8443df317cacb2ec13ab786e1fe2b533fb276bc6e4e76747f9050fd34b5806b4d79f2242588ef21a4cea0a7aeef7fbbd8ba9710a428b4f93208a909
-
memory/364-78-0x0000000000000000-mapping.dmp
-
memory/628-85-0x0000000002AF0000-0x0000000002C27000-memory.dmpFilesize
1.2MB
-
memory/628-84-0x0000000000480000-0x000000000050A000-memory.dmpFilesize
552KB
-
memory/628-86-0x0000000002C30000-0x0000000002D98000-memory.dmpFilesize
1.4MB
-
memory/628-80-0x0000000000080000-0x00000000000AC000-memory.dmpFilesize
176KB
-
memory/628-87-0x0000000000080000-0x00000000000AC000-memory.dmpFilesize
176KB
-
memory/628-77-0x0000000000000000-mapping.dmp
-
memory/672-75-0x0000000075081000-0x0000000075083000-memory.dmpFilesize
8KB
-
memory/672-76-0x0000000000080000-0x00000000000AC000-memory.dmpFilesize
176KB
-
memory/672-73-0x0000000000000000-mapping.dmp
-
memory/1376-64-0x0000000000250000-0x0000000000254000-memory.dmpFilesize
16KB
-
memory/1376-54-0x00000000761F1000-0x00000000761F3000-memory.dmpFilesize
8KB
-
memory/1380-71-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/1380-72-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/1380-70-0x0000000002250000-0x000000000225C000-memory.dmpFilesize
48KB
-
memory/1568-69-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1568-65-0x0000000000240000-0x000000000024C000-memory.dmpFilesize
48KB
-
memory/1568-63-0x0000000000418E20-mapping.dmp
-
memory/1568-62-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1568-61-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1568-59-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1568-58-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1568-56-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1568-55-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB