42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30

General

Target

42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe
Size

300KB
MD5

6d316c32ccb411b0c2e5d5c595f228ac
SHA1

528363b59474d6bc98af1c6047127293c000495f
SHA256

42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30
SHA512

088927806d14ef2e8b3e81fb45eb6e75f4b9853142a71baa5beae83952d92118e9a0d253086cc8283fcd3d2ed7ec84653a4bfe8bbbdc2d97af0207d6a33b9c3e
SSDEEP

3072:y2RN5GMOtUVOQ24iaw4CsaT1M4NFNbL+XclX8m2RbAvW6IeX7Hishb2cM7IjTbJe:jRNaUUQK4CblNWXkKkBrSyFJC

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ipocwwcx = "\"C:\\Windows\\ywaxojaf.exe\""	explorer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe

description	pid	process	target process
PID 1320 set thread context of 2020	1320	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe
PID 2020 set thread context of 364	2020	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe	explorer.exe

Drops file in Windows directory 2 IoCs

Processes:

explorer.exe

description ioc process

File opened for modification C:\Windows\ywaxojaf.exe explorer.exe
File created C:\Windows\ywaxojaf.exe explorer.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1912 vssadmin.exe

description	ioc	process
File opened for modification	C:\Windows\ywaxojaf.exe	explorer.exe
File created	C:\Windows\ywaxojaf.exe	explorer.exe

pid	process
1912	vssadmin.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PhishingFilter	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	explorer.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe

pid process

1320 42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 1852 vssvc.exe
Token: SeRestorePrivilege 1852 vssvc.exe
Token: SeAuditPrivilege 1852 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	1852	vssvc.exe
Token: SeRestorePrivilege	1852	vssvc.exe
Token: SeAuditPrivilege	1852	vssvc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe

pid	process
1320	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe
1320	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exeexplorer.exe

description	pid	process	target process
PID 1320 wrote to memory of 2020	1320	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe
PID 1320 wrote to memory of 2020	1320	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe
PID 1320 wrote to memory of 2020	1320	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe
PID 1320 wrote to memory of 2020	1320	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe
PID 1320 wrote to memory of 2020	1320	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe
PID 1320 wrote to memory of 2020	1320	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe
PID 1320 wrote to memory of 2020	1320	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe
PID 1320 wrote to memory of 2020	1320	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe
PID 1320 wrote to memory of 2020	1320	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe
PID 1320 wrote to memory of 2020	1320	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe
PID 1320 wrote to memory of 2020	1320	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe
PID 1320 wrote to memory of 2020	1320	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe
PID 2020 wrote to memory of 364	2020	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe	explorer.exe
PID 2020 wrote to memory of 364	2020	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe	explorer.exe
PID 2020 wrote to memory of 364	2020	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe	explorer.exe
PID 2020 wrote to memory of 364	2020	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe	explorer.exe
PID 2020 wrote to memory of 364	2020	42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe	explorer.exe
PID 364 wrote to memory of 1912	364	explorer.exe	vssadmin.exe
PID 364 wrote to memory of 1912	364	explorer.exe	vssadmin.exe
PID 364 wrote to memory of 1912	364	explorer.exe	vssadmin.exe
PID 364 wrote to memory of 1912	364	explorer.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe
"C:\Users\Admin\AppData\Local\Temp\42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320

C:\Users\Admin\AppData\Local\Temp\42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe
C:\Users\Admin\AppData\Local\Temp\42a80743b3a3950c0c5134d7820b8327ef32bb29f721a9f9e3204aab48b79e30.exe
2⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\system32\explorer.exe"
3⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer Phishing Filter
- Suspicious use of WriteProcessMemory
PID:364

C:\Windows\SysWOW64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
4⤵
- Interacts with shadow copies
PID:1912

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1852

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\odedatadojerogit\01000000
Filesize
300KB

MD5
62f3b40031646eafc84e54d9f005de88

SHA1
2ed8468f5f91e2bd4c6dc8d8ae84f9edc910e9ac

SHA256
681bedff4e3548a4647d31eeebd57cf8df3a3e03aed76e7348d82b5751146ab7

SHA512
96505bcb4e47efcaae34af211c35938cf731db6a122e971c947be4d7c02ee8d64c6142c4322c7cf79f235c59438060267d7717e6ac6fbf81ac0afd9192e90690

Download Submit
memory/364-84-0x00000000726A1000-0x00000000726A3000-memory.dmp

Filesize
8KB

Download
memory/364-82-0x0000000000080000-0x00000000000B8000-memory.dmp

Filesize
224KB

Download
memory/364-79-0x0000000074BF1000-0x0000000074BF3000-memory.dmp

Filesize
8KB

Download
memory/364-74-0x0000000000080000-0x00000000000B8000-memory.dmp

Filesize
224KB

Download
memory/364-76-0x000000000009A620-mapping.dmp

Download
memory/364-72-0x0000000000080000-0x00000000000B8000-memory.dmp

Filesize
224KB

Download
memory/1320-54-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

Filesize
8KB

Download
memory/1320-59-0x00000000002D0000-0x00000000002D4000-memory.dmp

Filesize
16KB

Download
memory/1912-83-0x0000000000000000-mapping.dmp

Download
memory/2020-68-0x000000000040ADDA-mapping.dmp

Download
memory/2020-71-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2020-67-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2020-65-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2020-64-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2020-78-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2020-63-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2020-61-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2020-81-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2020-58-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2020-57-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2020-55-0x00000000001B0000-0x00000000002AA000-memory.dmp

Filesize
1000KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads