Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 04:26
Static task
static1
Behavioral task
behavioral1
Sample
e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exe
Resource
win10v2004-20221111-en
General
-
Target
e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exe
-
Size
773KB
-
MD5
48fc525c80aea2a073b4e16f4a98646b
-
SHA1
aac1555af284530a0072a0a4caa8e55231f35427
-
SHA256
e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c
-
SHA512
8baecb449ecb48431cd5cfaf4d3b5b22b4e4f13e4b0d98fef74fa8e3149c6c737214c23b21ff69290ac5bdc90f0905e221c9fe43d32b3cf378e057e807c8bd71
-
SSDEEP
24576:DI0sDNiUfiPgI91k4geYZF2HSoHvwA6PfRAcOsA0:Dq5iUU5nSeYiHSoH94fK0
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\exyqqsir = "\"C:\\Windows\\ybuwutiq.exe\"" explorer.exe -
Processes:
e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exee58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exedescription pid process target process PID 1904 set thread context of 1744 1904 e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exe e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exe PID 1744 set thread context of 1772 1744 e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exe explorer.exe -
Drops file in Windows directory 2 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\Windows\ybuwutiq.exe explorer.exe File created C:\Windows\ybuwutiq.exe explorer.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 956 vssadmin.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PhishingFilter explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0" explorer.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1120 vssvc.exe Token: SeRestorePrivilege 1120 vssvc.exe Token: SeAuditPrivilege 1120 vssvc.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exee58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exeexplorer.exedescription pid process target process PID 1904 wrote to memory of 1744 1904 e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exe e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exe PID 1904 wrote to memory of 1744 1904 e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exe e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exe PID 1904 wrote to memory of 1744 1904 e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exe e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exe PID 1904 wrote to memory of 1744 1904 e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exe e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exe PID 1904 wrote to memory of 1744 1904 e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exe e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exe PID 1904 wrote to memory of 1744 1904 e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exe e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exe PID 1744 wrote to memory of 1772 1744 e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exe explorer.exe PID 1744 wrote to memory of 1772 1744 e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exe explorer.exe PID 1744 wrote to memory of 1772 1744 e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exe explorer.exe PID 1744 wrote to memory of 1772 1744 e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exe explorer.exe PID 1744 wrote to memory of 1772 1744 e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exe explorer.exe PID 1772 wrote to memory of 956 1772 explorer.exe vssadmin.exe PID 1772 wrote to memory of 956 1772 explorer.exe vssadmin.exe PID 1772 wrote to memory of 956 1772 explorer.exe vssadmin.exe PID 1772 wrote to memory of 956 1772 explorer.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exe"C:\Users\Admin\AppData\Local\Temp\e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exe"C:\Users\Admin\AppData\Local\Temp\e58768c3df867270aa9e3177709415005914b39d272623e8d296106ad5cf125c.exe"2⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"3⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer Phishing Filter
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet4⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\adyxihodaryrujum\01000000Filesize
773KB
MD5b891fdbe73cd4f8f37b4af6fb7203658
SHA1abc57e103af322654c1f43fa643548e070067c6b
SHA25662221e46c59bece54c15b093c6f9043a7a7abcf05f0750538ae27ad4ccefea02
SHA51272afa0855c27d17fb81acec8f556604ff22e9cb7eef97c2f1a2f86a046a7c18f895f15d5c35e8e04e31092017059eb61310807ace6da25f19b9988241172fdeb
-
memory/956-73-0x0000000000000000-mapping.dmp
-
memory/1744-56-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/1744-59-0x000000000040AD0A-mapping.dmp
-
memory/1744-60-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/1744-62-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/1744-71-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/1772-67-0x000000000009A540-mapping.dmp
-
memory/1772-69-0x0000000075591000-0x0000000075593000-memory.dmpFilesize
8KB
-
memory/1772-65-0x0000000000080000-0x00000000000B8000-memory.dmpFilesize
224KB
-
memory/1772-63-0x0000000000080000-0x00000000000B8000-memory.dmpFilesize
224KB
-
memory/1772-72-0x0000000000080000-0x00000000000B8000-memory.dmpFilesize
224KB
-
memory/1772-74-0x0000000073041000-0x0000000073043000-memory.dmpFilesize
8KB
-
memory/1772-75-0x0000000000080000-0x00000000000B8000-memory.dmpFilesize
224KB
-
memory/1904-54-0x0000000076DC1000-0x0000000076DC3000-memory.dmpFilesize
8KB
-
memory/1904-55-0x0000000000240000-0x0000000000248000-memory.dmpFilesize
32KB