905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4

General

Target

905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe
Size

249KB
MD5

2fc622ed6436577502a3257a4629ef9b
SHA1

fe4ef6a223c050cf826d360585388a7e365cf75d
SHA256

905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4
SHA512

a4c5701dc916773a92eef8be13849f65a605f6798cc34aaf62420a51e66f2cfb6193de6528ad2b1f1c48f5232c6bc837dbc53cf5e86c3e103848ea6a55d13a3b
SSDEEP

6144:88dNXSEpYKuWrbizInoZSg0HT5oDByPOne4Z54tssUyBRpt8NJB4pK6:npbuIqZSg0tmByPw5KENJB4pp

Score

9^/10

persistence ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Loads dropped DLL 4 IoCs

Processes:

905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe

pid	process
5100	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe
5100	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe
5100	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe
5100	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ufsrwpaw = "\"C:\\Windows\\aqovexol.exe\""	explorer.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe

description	pid	process	target process
PID 5100 set thread context of 3392	5100	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe
PID 3392 set thread context of 2056	3392	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe	explorer.exe

Drops file in Windows directory 2 IoCs

Processes:

explorer.exe

description ioc process

File opened for modification C:\Windows\aqovexol.exe explorer.exe
File created C:\Windows\aqovexol.exe explorer.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2024 vssadmin.exe

description	ioc	process
File opened for modification	C:\Windows\aqovexol.exe	explorer.exe
File created	C:\Windows\aqovexol.exe	explorer.exe

pid	process
2024	vssadmin.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\PhishingFilter	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	explorer.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 636 vssvc.exe
Token: SeRestorePrivilege 636 vssvc.exe
Token: SeAuditPrivilege 636 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	636	vssvc.exe
Token: SeRestorePrivilege	636	vssvc.exe
Token: SeAuditPrivilege	636	vssvc.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exeexplorer.exe

C:\Users\Admin\AppData\Local\Temp\905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe
"C:\Users\Admin\AppData\Local\Temp\905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5100

C:\Users\Admin\AppData\Local\Temp\905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe
"C:\Users\Admin\AppData\Local\Temp\905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3392

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\system32\explorer.exe"
3⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer Phishing Filter
- Suspicious use of WriteProcessMemory
PID:2056

C:\Windows\SYSTEM32\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
4⤵
- Interacts with shadow copies
PID:2024

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:636

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\idumewitynofyran\01000000
Filesize
249KB

MD5
f069897997fc2aa0a12daf0d810e179e

SHA1
826142d53e9e0b1bfbffbb256b12ac7281028368

SHA256
0daca4f146752af2b449065edea652e36b6a89d1a27da5e4a45d2cfe49b49612

SHA512
0cd2402ba6d74f81d252d66d9ca4d9abbb7dcee3ccd574c3d5043dc781700d1d3632db3c7a725600fdfd397e2c1b186eecea847f41810ec23e75fb99fb0bf934

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl23E4.tmp\UserInfo.dll
Filesize
4KB

MD5
d9a3fc12d56726dde60c1ead1df366f7

SHA1
f531768159c14f07ac896437445652b33750a237

SHA256
401f1a02000ff7cf9853d964dcba77e6f0fa8e57256b11ed3c01171d7a97388a

SHA512
6b06e3446df419151dd20cdb1d9c595fe9fb0972e7dfc50dadeea9f868d8ef0cd4cefcb18c7ebfc0d2a3e9171f8aa1f9fe762f54c374667f6060e8ce7e845f51

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl23E4.tmp\UserInfo.dll
Filesize
4KB

MD5
d9a3fc12d56726dde60c1ead1df366f7

SHA1
f531768159c14f07ac896437445652b33750a237

SHA256
401f1a02000ff7cf9853d964dcba77e6f0fa8e57256b11ed3c01171d7a97388a

SHA512
6b06e3446df419151dd20cdb1d9c595fe9fb0972e7dfc50dadeea9f868d8ef0cd4cefcb18c7ebfc0d2a3e9171f8aa1f9fe762f54c374667f6060e8ce7e845f51

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl23E4.tmp\UserInfo.dll
Filesize
4KB

MD5
d9a3fc12d56726dde60c1ead1df366f7

SHA1
f531768159c14f07ac896437445652b33750a237

SHA256
401f1a02000ff7cf9853d964dcba77e6f0fa8e57256b11ed3c01171d7a97388a

SHA512
6b06e3446df419151dd20cdb1d9c595fe9fb0972e7dfc50dadeea9f868d8ef0cd4cefcb18c7ebfc0d2a3e9171f8aa1f9fe762f54c374667f6060e8ce7e845f51

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl23E4.tmp\thalidomide.dll
Filesize
86KB

MD5
aa144b724f32bcda0499ab58bb841d5a

SHA1
51387b4b0e9f50d203c0c083151047982f6b6ca2

SHA256
64bb66d035a60097f7c75c24b9c04a47a32675b83c53e77270286009e4fd6807

SHA512
2e730c88cc07658554e81e2a95b2d0a9e6ee8a37a0cb2e08b1f6d614b2431d7baa067b47db7741e7ed472b58c27a232c5a0bf0c0fea98c12b668627053186771

Download Submit
memory/2024-146-0x0000000000000000-mapping.dmp

Download
memory/2056-142-0x0000000000F80000-0x0000000000FBC000-memory.dmp

Filesize
240KB

Download
memory/2056-141-0x0000000000000000-mapping.dmp

Download
memory/2056-147-0x0000000000F80000-0x0000000000FBC000-memory.dmp

Filesize
240KB

Download
memory/3392-140-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3392-139-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3392-137-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3392-145-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3392-136-0x0000000000000000-mapping.dmp

Download

description	pid	process	target process
PID 5100 wrote to memory of 3392	5100	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe
PID 5100 wrote to memory of 3392	5100	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe
PID 5100 wrote to memory of 3392	5100	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe
PID 5100 wrote to memory of 3392	5100	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe
PID 5100 wrote to memory of 3392	5100	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe
PID 5100 wrote to memory of 3392	5100	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe
PID 5100 wrote to memory of 3392	5100	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe
PID 5100 wrote to memory of 3392	5100	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe
PID 5100 wrote to memory of 3392	5100	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe
PID 5100 wrote to memory of 3392	5100	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe
PID 3392 wrote to memory of 2056	3392	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe	explorer.exe
PID 3392 wrote to memory of 2056	3392	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe	explorer.exe
PID 3392 wrote to memory of 2056	3392	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe	explorer.exe
PID 3392 wrote to memory of 2056	3392	905de398fceeb170bcd45f8ee169b90384441bb04dae8dee3ee7878c0ed2d0a4.exe	explorer.exe
PID 2056 wrote to memory of 2024	2056	explorer.exe	vssadmin.exe
PID 2056 wrote to memory of 2024	2056	explorer.exe	vssadmin.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads