Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 04:26
Static task
static1
Behavioral task
behavioral1
Sample
47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe
Resource
win10v2004-20220812-en
General
-
Target
47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe
-
Size
777KB
-
MD5
5b712f99b32783231704adc73a251e46
-
SHA1
cf0589c32b4d18303e194672a7710fd6a9a655d6
-
SHA256
47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f
-
SHA512
b3d45c54a9280534ea6471f252635f5cc04cb8a95f70d87041af24033f21db332184eaba72149c29b1028ba8d84fdfe0b54c46dd91952ca930bebb2a297c22dd
-
SSDEEP
12288:nZ+pDu9YrDQKiXEfiVzhY1Iys0P9ckXgeteabKSctHSoHJD4XWdFvn:n80sDNiUfiPgI91kXgeYEF2HSoHYCFf
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\elophqiq = "\"C:\\Windows\\izaxogif.exe\"" explorer.exe -
Processes:
47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exedescription pid process target process PID 1696 set thread context of 1688 1696 47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe 47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe PID 1688 set thread context of 1124 1688 47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe explorer.exe -
Drops file in Windows directory 2 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\Windows\izaxogif.exe explorer.exe File created C:\Windows\izaxogif.exe explorer.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1720 vssadmin.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0" explorer.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PhishingFilter explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" explorer.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1752 vssvc.exe Token: SeRestorePrivilege 1752 vssvc.exe Token: SeAuditPrivilege 1752 vssvc.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exeexplorer.exedescription pid process target process PID 1696 wrote to memory of 1688 1696 47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe 47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe PID 1696 wrote to memory of 1688 1696 47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe 47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe PID 1696 wrote to memory of 1688 1696 47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe 47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe PID 1696 wrote to memory of 1688 1696 47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe 47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe PID 1696 wrote to memory of 1688 1696 47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe 47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe PID 1696 wrote to memory of 1688 1696 47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe 47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe PID 1688 wrote to memory of 1124 1688 47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe explorer.exe PID 1688 wrote to memory of 1124 1688 47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe explorer.exe PID 1688 wrote to memory of 1124 1688 47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe explorer.exe PID 1688 wrote to memory of 1124 1688 47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe explorer.exe PID 1688 wrote to memory of 1124 1688 47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe explorer.exe PID 1124 wrote to memory of 1720 1124 explorer.exe vssadmin.exe PID 1124 wrote to memory of 1720 1124 explorer.exe vssadmin.exe PID 1124 wrote to memory of 1720 1124 explorer.exe vssadmin.exe PID 1124 wrote to memory of 1720 1124 explorer.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe"C:\Users\Admin\AppData\Local\Temp\47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe"C:\Users\Admin\AppData\Local\Temp\47f84419a3c49e289492b9e348c14c268b117cd26964746fa65318c893cbe81f.exe"2⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"3⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer Phishing Filter
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet4⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\idumewitynofyran\01000000Filesize
777KB
MD57e26c44c749bf583c763b97249ff43fb
SHA13f4b5f9ef4ce9e3d63ace5b8a153e27c76a8e679
SHA2569f6ea141268bd6234c7445b3d3d16b920d810905c0301746ef09ad9aefd4c6c8
SHA512a494fb3a66147a13957083a977e8c88a73907519ead560ea796ba9bd1ffea89dadcf48e37f6bf71739bcb0660c4bc754771785a3ec4eaf1d64c0d507f295d81a
-
memory/1124-72-0x00000000000D0000-0x000000000010C000-memory.dmpFilesize
240KB
-
memory/1124-69-0x00000000752D1000-0x00000000752D3000-memory.dmpFilesize
8KB
-
memory/1124-75-0x00000000000D0000-0x000000000010C000-memory.dmpFilesize
240KB
-
memory/1124-74-0x0000000072E81000-0x0000000072E83000-memory.dmpFilesize
8KB
-
memory/1124-67-0x00000000000EA140-mapping.dmp
-
memory/1124-63-0x00000000000D0000-0x000000000010C000-memory.dmpFilesize
240KB
-
memory/1124-65-0x00000000000D0000-0x000000000010C000-memory.dmpFilesize
240KB
-
memory/1688-62-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1688-56-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1688-71-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1688-60-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1688-59-0x000000000040A61E-mapping.dmp
-
memory/1696-55-0x00000000001D0000-0x00000000001D8000-memory.dmpFilesize
32KB
-
memory/1696-54-0x00000000766D1000-0x00000000766D3000-memory.dmpFilesize
8KB
-
memory/1720-73-0x0000000000000000-mapping.dmp