1d604efdc5016ceaef958b6f4f74e368ecfdb34cf814ce424a6793f9e16e14ad

General

Target

Message.Pdf_____________________________________________________________.exe
Size

459KB
MD5

31559db5ce662400dccef6f781b4218d
SHA1

66567121269f253f0282ecc04ad981dae54959d9
SHA256

b89e0e608175629cb724fa36e35147a81a0d48b3b1c15656783b47e7b9bd8845
SHA512

a5099e62537179fcda5e039cf0dace1753c5db550edb505dfdbbb1d342b5566d6cd712e48a8d9f900be947904aa4ea330d3d41cd7b9db0655837dc5ec93373a9
SSDEEP

12288:pnUNbLVGziGw9t89zIFEqJAosf6yqTRNnh:uNLVMxu7fh

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qvahagap = "C:\\Windows\\esivagow.exe"	explorer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Message.Pdf_____________________________________________________________.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1452 set thread context of 1512	1452	Message.Pdf_____________________________________________________________.exe	28
PID 1512 set thread context of 1716	1512	Message.Pdf_____________________________________________________________.exe	29

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\esivagow.exe	explorer.exe
File created	C:\Windows\esivagow.exe	explorer.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1428	vssadmin.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	836	vssvc.exe
Token: SeRestorePrivilege	836	vssvc.exe
Token: SeAuditPrivilege	836	vssvc.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 1512	1452	Message.Pdf_____________________________________________________________.exe	28
PID 1452 wrote to memory of 1512	1452	Message.Pdf_____________________________________________________________.exe	28
PID 1452 wrote to memory of 1512	1452	Message.Pdf_____________________________________________________________.exe	28
PID 1452 wrote to memory of 1512	1452	Message.Pdf_____________________________________________________________.exe	28
PID 1452 wrote to memory of 1512	1452	Message.Pdf_____________________________________________________________.exe	28
PID 1452 wrote to memory of 1512	1452	Message.Pdf_____________________________________________________________.exe	28
PID 1452 wrote to memory of 1512	1452	Message.Pdf_____________________________________________________________.exe	28
PID 1452 wrote to memory of 1512	1452	Message.Pdf_____________________________________________________________.exe	28
PID 1452 wrote to memory of 1512	1452	Message.Pdf_____________________________________________________________.exe	28
PID 1452 wrote to memory of 1512	1452	Message.Pdf_____________________________________________________________.exe	28
PID 1512 wrote to memory of 1716	1512	Message.Pdf_____________________________________________________________.exe	29
PID 1512 wrote to memory of 1716	1512	Message.Pdf_____________________________________________________________.exe	29
PID 1512 wrote to memory of 1716	1512	Message.Pdf_____________________________________________________________.exe	29
PID 1512 wrote to memory of 1716	1512	Message.Pdf_____________________________________________________________.exe	29
PID 1512 wrote to memory of 1716	1512	Message.Pdf_____________________________________________________________.exe	29
PID 1716 wrote to memory of 1428	1716	explorer.exe	30
PID 1716 wrote to memory of 1428	1716	explorer.exe	30
PID 1716 wrote to memory of 1428	1716	explorer.exe	30
PID 1716 wrote to memory of 1428	1716	explorer.exe	30

C:\Users\Admin\AppData\Local\Temp\Message.Pdf_____________________________________________________________.exe
"C:\Users\Admin\AppData\Local\Temp\Message.Pdf_____________________________________________________________.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Users\Admin\AppData\Local\Temp\Message.Pdf_____________________________________________________________.exe
  "C:\Users\Admin\AppData\Local\Temp\Message.Pdf_____________________________________________________________.exe"
  2⤵
  - Checks whether UAC is enabled
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\system32\explorer.exe"
    3⤵
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1716
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin.exe Delete Shadows /All /Quiet
      4⤵
      Interacts with shadow copies
      PID:1428

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ihyzetobyzizyqeq\01000000

Filesize
459KB

MD5
7a1a10f497640bcb9f6e5b69ea8e1d65

SHA1
e4addda58bc2b090dd9d1eb3ea647a4f4b81a0ef

SHA256
e600e191efaa308923c5e0d593c2177ce6748c7e0422b980e09cc606b5efdbfb

SHA512
5e492f07c56a869c558b05624fd38d2b2dd32174aa3353093e9975db6ba97bbeb507175e7630bc3c85f8d63101c65e1b05def9be422f97266923bfc22b7f9518

Download Submit
memory/1452-54-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/1512-62-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1512-78-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1512-60-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1512-64-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1512-66-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1512-68-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1512-69-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1512-55-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1512-61-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1512-58-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1716-76-0x0000000075471000-0x0000000075473000-memory.dmp

Filesize
8KB

Download
memory/1716-72-0x0000000000380000-0x00000000003BB000-memory.dmp

Filesize
236KB

Download
memory/1716-79-0x0000000000380000-0x00000000003BB000-memory.dmp

Filesize
236KB

Download
memory/1716-70-0x0000000000380000-0x00000000003BB000-memory.dmp

Filesize
236KB

Download
memory/1716-81-0x0000000073011000-0x0000000073013000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing