Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 08:29
Static task
static1
Behavioral task
behavioral1
Sample
605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe
Resource
win10v2004-20221111-en
General
-
Target
605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe
-
Size
316KB
-
MD5
6a60a270addbfad002914e5a5bc5ef0e
-
SHA1
510b3203b1a7f0385cda3bc2aa7e7d53c9168f6b
-
SHA256
605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710
-
SHA512
6efc8826704c98d49316a0d5b45927933a5d44d428d9ede192acea11662cb8cec0811eefdd6e4e534e4445c6f0fc572232e0696947c6871d91abc81f8fe937ef
-
SSDEEP
6144:O3UhrPPvuEQo0PwM2by87ts+c5/IYHdp8G/:O3czuEQYMOv5R0/IYHL8G/
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sropunac = "C:\\Windows\\ecujpgav.exe" explorer.exe -
Processes:
605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exedescription pid process target process PID 1500 set thread context of 872 1500 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe PID 872 set thread context of 1756 872 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe explorer.exe -
Drops file in Windows directory 2 IoCs
Processes:
explorer.exedescription ioc process File created C:\Windows\ecujpgav.exe explorer.exe File opened for modification C:\Windows\ecujpgav.exe explorer.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 968 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exepid process 1500 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe 1500 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1752 vssvc.exe Token: SeRestorePrivilege 1752 vssvc.exe Token: SeAuditPrivilege 1752 vssvc.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exeexplorer.exedescription pid process target process PID 1500 wrote to memory of 872 1500 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe PID 1500 wrote to memory of 872 1500 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe PID 1500 wrote to memory of 872 1500 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe PID 1500 wrote to memory of 872 1500 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe PID 1500 wrote to memory of 872 1500 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe PID 1500 wrote to memory of 872 1500 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe PID 1500 wrote to memory of 872 1500 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe PID 1500 wrote to memory of 872 1500 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe PID 1500 wrote to memory of 872 1500 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe PID 1500 wrote to memory of 872 1500 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe PID 1500 wrote to memory of 872 1500 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe PID 872 wrote to memory of 1756 872 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe explorer.exe PID 872 wrote to memory of 1756 872 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe explorer.exe PID 872 wrote to memory of 1756 872 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe explorer.exe PID 872 wrote to memory of 1756 872 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe explorer.exe PID 872 wrote to memory of 1756 872 605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe explorer.exe PID 1756 wrote to memory of 968 1756 explorer.exe vssadmin.exe PID 1756 wrote to memory of 968 1756 explorer.exe vssadmin.exe PID 1756 wrote to memory of 968 1756 explorer.exe vssadmin.exe PID 1756 wrote to memory of 968 1756 explorer.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe"C:\Users\Admin\AppData\Local\Temp\605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe"C:\Users\Admin\AppData\Local\Temp\605116c6b8a84efa4e25bd42f75ee8f88e02f7cff895fb434a55ce9ddfc9b710.exe"2⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"3⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet4⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\uluxohydelujynyf\01000000Filesize
316KB
MD55ff7dbdc6c5ba3ace0190ff3a458bf3d
SHA134cf93246ebd1168b56969fb278beee8b41c6de7
SHA25696b2769d01f671a4bccfc66b722e8a084729e67241d125243e8d7dd7f8c79841
SHA512500aa9633cba98774e6d9a65b88d8d57818fb773165ce3b280a4df9602e8aeba95467743f3110c62046ef5e10affe7c1fa633e037382d1b8d3c1ef4464948f1b
-
memory/872-62-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/872-56-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/872-58-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/872-60-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/872-61-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/872-55-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/872-64-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/872-65-0x000000000040A7BE-mapping.dmp
-
memory/872-68-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/872-70-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/872-79-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/968-81-0x0000000000000000-mapping.dmp
-
memory/1500-69-0x0000000000230000-0x0000000000259000-memory.dmpFilesize
164KB
-
memory/1500-54-0x0000000075B41000-0x0000000075B43000-memory.dmpFilesize
8KB
-
memory/1756-75-0x0000000000119C80-mapping.dmp
-
memory/1756-77-0x0000000074C81000-0x0000000074C83000-memory.dmpFilesize
8KB
-
memory/1756-73-0x0000000000100000-0x000000000013B000-memory.dmpFilesize
236KB
-
memory/1756-71-0x0000000000100000-0x000000000013B000-memory.dmpFilesize
236KB
-
memory/1756-80-0x0000000000100000-0x000000000013B000-memory.dmpFilesize
236KB
-
memory/1756-82-0x0000000072BB1000-0x0000000072BB3000-memory.dmpFilesize
8KB