5fc92308120aa10dc1062c4c319559ed0b1308befe117d5cafa283e245bea1e9

Analysis

max time kernel
208s
max time network
213s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 08:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5fc92308120aa10dc1062c4c319559ed0b1308befe117d5cafa283e245bea1e9.exe
Size

220KB
MD5

941fb1cd3fdab89abc35f0a21abd2f45
SHA1

349c15855c91c341db0bc01cc328a17a3554cbc4
SHA256

5fc92308120aa10dc1062c4c319559ed0b1308befe117d5cafa283e245bea1e9
SHA512

14cf15e0f84f821adfd4dfe3037421291f296e9613db3f77405053e2b4a9a2e18625c2425a56af02bb479ff8e5c6b2eb45808d0054b5dbefd3d9cba213c0ade5
SSDEEP

3072:sTVZEA0R5UeyVSzeIw6upojbcbf0L1siwNGRRH9fZvl2hZm6nE:sxWA0EeKvpdbf0L1si9H9fZvj6E

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\osocujof = "C:\\Windows\\upuzemoh.exe"	explorer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5fc92308120aa10dc1062c4c319559ed0b1308befe117d5cafa283e245bea1e9.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4240 set thread context of 4644	4240	5fc92308120aa10dc1062c4c319559ed0b1308befe117d5cafa283e245bea1e9.exe	80

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\upuzemoh.exe	explorer.exe
File created	C:\Windows\upuzemoh.exe	explorer.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1284	vssadmin.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	4448	vssvc.exe
Token: SeRestorePrivilege	4448	vssvc.exe
Token: SeAuditPrivilege	4448	vssvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 4644	4240	5fc92308120aa10dc1062c4c319559ed0b1308befe117d5cafa283e245bea1e9.exe	80
PID 4240 wrote to memory of 4644	4240	5fc92308120aa10dc1062c4c319559ed0b1308befe117d5cafa283e245bea1e9.exe	80
PID 4240 wrote to memory of 4644	4240	5fc92308120aa10dc1062c4c319559ed0b1308befe117d5cafa283e245bea1e9.exe	80
PID 4240 wrote to memory of 4644	4240	5fc92308120aa10dc1062c4c319559ed0b1308befe117d5cafa283e245bea1e9.exe	80
PID 4644 wrote to memory of 1284	4644	explorer.exe	81
PID 4644 wrote to memory of 1284	4644	explorer.exe	81

C:\Users\Admin\AppData\Local\Temp\5fc92308120aa10dc1062c4c319559ed0b1308befe117d5cafa283e245bea1e9.exe
"C:\Users\Admin\AppData\Local\Temp\5fc92308120aa10dc1062c4c319559ed0b1308befe117d5cafa283e245bea1e9.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\system32\explorer.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\SYSTEM32\vssadmin.exe
    vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:1284

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4448

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact