ec07de066b60552dcd3a9abfab35d3afb300122fb346750aba618dab059bfa23

General

Target

MensajePdf_____________________________________________________________.exe
Size

313KB
MD5

97b0a298b70cbb33056e43cd3360a096
SHA1

a6ccdae016b8330c0ff44a694b44108f37eea595
SHA256

78167371bd593b20a32902f0e3182d892b047521a1185904305671b6bafd51ab
SHA512

89c7e317b11579e636aa07b3e50d110ec23f0d5e10fedf90543f1d9ca291871ea7337c7adfeef49377eaaa7ec607f05103ee339495a39a49533fbee2014f4f1a
SSDEEP

6144:l24g1A0OvpVXJ8Q0T2c/H+csQMxnw9OoteG7qIEjp/4UQ1Ms:84g1A0OvDJI2c3sQNIotjup91

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yryjuskg = "C:\\Windows\\ugatqlij.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	explorer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

MensajePdf_____________________________________________________________.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MensajePdf_____________________________________________________________.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

MensajePdf_____________________________________________________________.exe

description	pid	process	target process
PID 1744 set thread context of 768	1744	MensajePdf_____________________________________________________________.exe	explorer.exe

Drops file in Windows directory 2 IoCs

Processes:

explorer.exe

description ioc process

File opened for modification C:\Windows\ugatqlij.exe explorer.exe
File created C:\Windows\ugatqlij.exe explorer.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

540 vssadmin.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 1656 vssvc.exe
Token: SeRestorePrivilege 1656 vssvc.exe
Token: SeAuditPrivilege 1656 vssvc.exe

description	ioc	process
File opened for modification	C:\Windows\ugatqlij.exe	explorer.exe
File created	C:\Windows\ugatqlij.exe	explorer.exe

pid	process
540	vssadmin.exe

description	pid	process
Token: SeBackupPrivilege	1656	vssvc.exe
Token: SeRestorePrivilege	1656	vssvc.exe
Token: SeAuditPrivilege	1656	vssvc.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

MensajePdf_____________________________________________________________.exeexplorer.exe

description	pid	process	target process
PID 1744 wrote to memory of 768	1744	MensajePdf_____________________________________________________________.exe	explorer.exe
PID 1744 wrote to memory of 768	1744	MensajePdf_____________________________________________________________.exe	explorer.exe
PID 1744 wrote to memory of 768	1744	MensajePdf_____________________________________________________________.exe	explorer.exe
PID 1744 wrote to memory of 768	1744	MensajePdf_____________________________________________________________.exe	explorer.exe
PID 1744 wrote to memory of 768	1744	MensajePdf_____________________________________________________________.exe	explorer.exe
PID 768 wrote to memory of 540	768	explorer.exe	vssadmin.exe
PID 768 wrote to memory of 540	768	explorer.exe	vssadmin.exe
PID 768 wrote to memory of 540	768	explorer.exe	vssadmin.exe
PID 768 wrote to memory of 540	768	explorer.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\MensajePdf_____________________________________________________________.exe
"C:\Users\Admin\AppData\Local\Temp\MensajePdf_____________________________________________________________.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\system32\explorer.exe"
2⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:768

C:\Windows\SysWOW64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
3⤵
- Interacts with shadow copies
PID:540

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1656

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ewosolyzuhobytal\01000000
Filesize
313KB

MD5
179c3daef6cad1c34bdf0aab7118f0d4

SHA1
19a933977f51f3a5b23dc17bf28a38e966b590d0

SHA256
3c044157e5e1995baa6d0a97d9033822ce19324323f4e0ed8248ec934f0d6379

SHA512
61391f37feae2f0842318a4cc7a29df9873f13abff8da544b2a4f772b073c07f25f8ca811057b81daaf3ff43bf592a7da2c44afb4548670da6b49efe9c512e53

Download Submit
memory/540-67-0x0000000000000000-mapping.dmp

Download
memory/768-58-0x0000000000130000-0x000000000016B000-memory.dmp

Filesize
236KB

Download
memory/768-60-0x0000000000130000-0x000000000016B000-memory.dmp

Filesize
236KB

Download
memory/768-62-0x0000000000149C80-mapping.dmp

Download
memory/768-64-0x0000000074061000-0x0000000074063000-memory.dmp

Filesize
8KB

Download
memory/768-66-0x0000000000130000-0x000000000016B000-memory.dmp

Filesize
236KB

Download
memory/768-68-0x00000000721D1000-0x00000000721D3000-memory.dmp

Filesize
8KB

Download
memory/768-69-0x0000000000130000-0x000000000016B000-memory.dmp

Filesize
236KB

Download
memory/1744-54-0x0000000075A31000-0x0000000075A33000-memory.dmp

Filesize
8KB

Download
memory/1744-55-0x0000000002380000-0x00000000024D5000-memory.dmp

Filesize
1.3MB

Download
memory/1744-56-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads