3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510

General

Target

3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe
Size

233KB
MD5

c2efdab47b2d73830a22c9ac0b657312
SHA1

f2a4a936724801711b53ff762a56e224ea27fd30
SHA256

3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510
SHA512

3ada1a8e690e434a16946ce9db8fc5208f9953aeeb07096e3f63b3279ae2b86d4efbfda10f5534d734379cb2676e0a9c780381f1ae5ff53c61626c5787352831
SSDEEP

6144:88dNXSEpKv7eR9aG9S/W8h2srCg8EMeFSjsJuEi+w8WlCc2Oz2Yxl:npKvK7r9S/PfCaMdlJ8WQO1l

Score

9^/10

persistence ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Loads dropped DLL 4 IoCs

Processes:

3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe

pid	process
544	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe
544	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe
544	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe
544	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qdivexyj = "\"C:\\Windows\\ebfqzcyv.exe\""	explorer.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe

description	pid	process	target process
PID 544 set thread context of 3432	544	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe
PID 3432 set thread context of 1528	3432	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe	explorer.exe

Drops file in Windows directory 2 IoCs

Processes:

explorer.exe

description ioc process

File opened for modification C:\Windows\ebfqzcyv.exe explorer.exe
File created C:\Windows\ebfqzcyv.exe explorer.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2816 vssadmin.exe

description	ioc	process
File opened for modification	C:\Windows\ebfqzcyv.exe	explorer.exe
File created	C:\Windows\ebfqzcyv.exe	explorer.exe

pid	process
2816	vssadmin.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\PhishingFilter	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	explorer.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 4008 vssvc.exe
Token: SeRestorePrivilege 4008 vssvc.exe
Token: SeAuditPrivilege 4008 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	4008	vssvc.exe
Token: SeRestorePrivilege	4008	vssvc.exe
Token: SeAuditPrivilege	4008	vssvc.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exeexplorer.exe

C:\Users\Admin\AppData\Local\Temp\3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe
"C:\Users\Admin\AppData\Local\Temp\3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:544

C:\Users\Admin\AppData\Local\Temp\3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe
"C:\Users\Admin\AppData\Local\Temp\3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3432

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\system32\explorer.exe"
3⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer Phishing Filter
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\SYSTEM32\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
4⤵
- Interacts with shadow copies
PID:2816

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4008

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\aduqeliginopicah\01000000
Filesize
233KB

MD5
e5ce6ce8b3e68c3f128e6f754499a995

SHA1
455328e202a344c26b6092ee32f9d133e93232ed

SHA256
31f3f575f2000ea41d9269e11ec3095691104d798f3ac88ce984e3d5c56c0498

SHA512
e94cc70f46cf22e40bd83be0ce3cb4354702359cf596f19dbe5e74be6166e482e951dc51ae090c06c9c28cf7f5beac9053b548954e5e11647df1803f41edcd61

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv542C.tmp\UserInfo.dll
Filesize
4KB

MD5
d9a3fc12d56726dde60c1ead1df366f7

SHA1
f531768159c14f07ac896437445652b33750a237

SHA256
401f1a02000ff7cf9853d964dcba77e6f0fa8e57256b11ed3c01171d7a97388a

SHA512
6b06e3446df419151dd20cdb1d9c595fe9fb0972e7dfc50dadeea9f868d8ef0cd4cefcb18c7ebfc0d2a3e9171f8aa1f9fe762f54c374667f6060e8ce7e845f51

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv542C.tmp\UserInfo.dll
Filesize
4KB

MD5
d9a3fc12d56726dde60c1ead1df366f7

SHA1
f531768159c14f07ac896437445652b33750a237

SHA256
401f1a02000ff7cf9853d964dcba77e6f0fa8e57256b11ed3c01171d7a97388a

SHA512
6b06e3446df419151dd20cdb1d9c595fe9fb0972e7dfc50dadeea9f868d8ef0cd4cefcb18c7ebfc0d2a3e9171f8aa1f9fe762f54c374667f6060e8ce7e845f51

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv542C.tmp\UserInfo.dll
Filesize
4KB

MD5
d9a3fc12d56726dde60c1ead1df366f7

SHA1
f531768159c14f07ac896437445652b33750a237

SHA256
401f1a02000ff7cf9853d964dcba77e6f0fa8e57256b11ed3c01171d7a97388a

SHA512
6b06e3446df419151dd20cdb1d9c595fe9fb0972e7dfc50dadeea9f868d8ef0cd4cefcb18c7ebfc0d2a3e9171f8aa1f9fe762f54c374667f6060e8ce7e845f51

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv542C.tmp\feasts.dll
Filesize
48KB

MD5
f8b664669551e3ddbe6232bafaaa62ed

SHA1
e1ce3ec5d31773931c2d844a1445fae482399f04

SHA256
6ba48336c7498374aed12fab70d8bbc7b6def4570b12a3a03853e321ea547464

SHA512
065360c868500fa5ca62745437b6b3aa5976ff0cff408315034c017adfbe6eba786fb5054334cc8bc2a19a372081cfd559ec7b51f055bd664802214989c9da61

Download Submit
memory/1528-142-0x0000000000000000-mapping.dmp

Download
memory/1528-143-0x00000000001C0000-0x00000000001FC000-memory.dmp

Filesize
240KB

Download
memory/1528-147-0x00000000001C0000-0x00000000001FC000-memory.dmp

Filesize
240KB

Download
memory/1528-148-0x00000000001C0000-0x00000000001FC000-memory.dmp

Filesize
240KB

Download
memory/2816-149-0x0000000000000000-mapping.dmp

Download
memory/3432-140-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3432-141-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3432-138-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3432-137-0x0000000000000000-mapping.dmp

Download
memory/3432-146-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download

description	pid	process	target process
PID 544 wrote to memory of 3432	544	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe
PID 544 wrote to memory of 3432	544	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe
PID 544 wrote to memory of 3432	544	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe
PID 544 wrote to memory of 3432	544	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe
PID 544 wrote to memory of 3432	544	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe
PID 544 wrote to memory of 3432	544	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe
PID 544 wrote to memory of 3432	544	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe
PID 544 wrote to memory of 3432	544	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe
PID 544 wrote to memory of 3432	544	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe
PID 544 wrote to memory of 3432	544	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe
PID 3432 wrote to memory of 1528	3432	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe	explorer.exe
PID 3432 wrote to memory of 1528	3432	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe	explorer.exe
PID 3432 wrote to memory of 1528	3432	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe	explorer.exe
PID 3432 wrote to memory of 1528	3432	3b84ede7ebb5ee92eb35516bd5f5d879a87ff683d1cd5e9f4b5f544ceb69a510.exe	explorer.exe
PID 1528 wrote to memory of 2816	1528	explorer.exe	vssadmin.exe
PID 1528 wrote to memory of 2816	1528	explorer.exe	vssadmin.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads