Analysis

  • max time kernel
    147s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    28-11-2022 04:27

General

  • Target

    2c24e2ea9dd67a5e72971185c262d2565a60ee90bbe731d5b25b21bbbf70b213.exe

  • Size

    129KB

  • MD5

    8b9761ee9ec7bed04d40900ba31f1cc8

  • SHA1

    6e9d2ac90b7548eb7c2577a4463e496795941a99

  • SHA256

    2c24e2ea9dd67a5e72971185c262d2565a60ee90bbe731d5b25b21bbbf70b213

  • SHA512

    6a6b4767e341c15117fd817783b705f4ff8a0e4d8aef4d1f4cef8e5ca1124711e7ed5a08b21407a468c3a2cc7b766ac0a1dd5b840298c558a78798760c1c557c

  • SSDEEP

    3072:6hRx8zd/EtzAAa1roAl4bI+m/B6SVqCgQfBUnPy8L66iiSM:6hkdEt8AMrmI+m/B6SVqCgQfBUPy8L6H

Malware Config

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2c24e2ea9dd67a5e72971185c262d2565a60ee90bbe731d5b25b21bbbf70b213.exe
    "C:\Users\Admin\AppData\Local\Temp\2c24e2ea9dd67a5e72971185c262d2565a60ee90bbe731d5b25b21bbbf70b213.exe"
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1648
    • C:\Windows\syswow64\explorer.exe
      "C:\Windows\syswow64\explorer.exe"
      2⤵
      • Drops startup file
      • Adds Run key to start application
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:608
      • C:\Windows\syswow64\svchost.exe
        -k netsvcs
        3⤵
          PID:1264
        • C:\Windows\syswow64\vssadmin.exe
          vssadmin.exe Delete Shadows /All /Quiet
          3⤵
          • Interacts with shadow copies
          PID:1496
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1644

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    File Deletion

    2
    T1107

    Modify Registry

    1
    T1112

    Impact

    Inhibit System Recovery

    2
    T1490

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/608-54-0x0000000000000000-mapping.dmp
    • memory/608-55-0x0000000075811000-0x0000000075813000-memory.dmp
      Filesize

      8KB

    • memory/608-56-0x0000000074A41000-0x0000000074A43000-memory.dmp
      Filesize

      8KB

    • memory/608-57-0x0000000000100000-0x0000000000125000-memory.dmp
      Filesize

      148KB

    • memory/1264-58-0x0000000000000000-mapping.dmp
    • memory/1264-61-0x00000000000C0000-0x00000000000E5000-memory.dmp
      Filesize

      148KB

    • memory/1496-59-0x0000000000000000-mapping.dmp