eed98c3dd55f27a2be5b8541b4855244fb065ade41ded068ab1317c776a09688

General

Target

3F5D43765B9861EF7FB6934E4F3BC696.exe
Size

343KB
MD5

3f5d43765b9861ef7fb6934e4f3bc696
SHA1

06fcd3e560876ad05f2f582f91547a04bff829f1
SHA256

eed98c3dd55f27a2be5b8541b4855244fb065ade41ded068ab1317c776a09688
SHA512

f9125a3a044f57bf4f3d169afcec97df7290fc2898aa2732c0e8b5afb2a5aa7099067f9e96e4644b6e0ffc5206c100654406baa7005b7071aaf9975d37c519aa
SSDEEP

3072:DQ8Jstxp5/YDHh8fzYQYwRVyv6MIWoy+hdEdZTpDbexB7sg+Rhtk7v:UBxpkhFQt4v67oA6rgsrIL

Score

10^/10

persistence phishing ransomware

Malware Config

Signatures

Detected phishing page
phishing
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Drops startup file 1 IoCs

Processes:

explorer.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\526932a.exe explorer.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\526932a.exe	explorer.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\526932 = "C:\\526932a\\526932a.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*26932 = "C:\\526932a\\526932a.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\526932a = "C:\\Users\\Admin\\AppData\\Roaming\\526932a.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*26932a = "C:\\Users\\Admin\\AppData\\Roaming\\526932a.exe"	explorer.exe

Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ip-addr.es
4 myexternalip.com
6 myexternalip.com
92 myexternalip.com
124 myexternalip.com
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1600 vssadmin.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

3F5D43765B9861EF7FB6934E4F3BC696.exeexplorer.exe

pid process

580 3F5D43765B9861EF7FB6934E4F3BC696.exe
272 explorer.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 896 vssvc.exe
Token: SeRestorePrivilege 896 vssvc.exe
Token: SeAuditPrivilege 896 vssvc.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

3F5D43765B9861EF7FB6934E4F3BC696.exe

pid process

580 3F5D43765B9861EF7FB6934E4F3BC696.exe

flow	ioc
2	ip-addr.es
4	myexternalip.com
6	myexternalip.com
92	myexternalip.com
124	myexternalip.com

pid	process
1600	vssadmin.exe

pid	process
580	3F5D43765B9861EF7FB6934E4F3BC696.exe
272	explorer.exe

description	pid	process
Token: SeBackupPrivilege	896	vssvc.exe
Token: SeRestorePrivilege	896	vssvc.exe
Token: SeAuditPrivilege	896	vssvc.exe

pid	process
580	3F5D43765B9861EF7FB6934E4F3BC696.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

3F5D43765B9861EF7FB6934E4F3BC696.exeexplorer.exe

description	pid	process	target process
PID 580 wrote to memory of 272	580	3F5D43765B9861EF7FB6934E4F3BC696.exe	explorer.exe
PID 580 wrote to memory of 272	580	3F5D43765B9861EF7FB6934E4F3BC696.exe	explorer.exe
PID 580 wrote to memory of 272	580	3F5D43765B9861EF7FB6934E4F3BC696.exe	explorer.exe
PID 580 wrote to memory of 272	580	3F5D43765B9861EF7FB6934E4F3BC696.exe	explorer.exe
PID 272 wrote to memory of 1668	272	explorer.exe	svchost.exe
PID 272 wrote to memory of 1668	272	explorer.exe	svchost.exe
PID 272 wrote to memory of 1668	272	explorer.exe	svchost.exe
PID 272 wrote to memory of 1668	272	explorer.exe	svchost.exe
PID 272 wrote to memory of 1600	272	explorer.exe	vssadmin.exe
PID 272 wrote to memory of 1600	272	explorer.exe	vssadmin.exe
PID 272 wrote to memory of 1600	272	explorer.exe	vssadmin.exe
PID 272 wrote to memory of 1600	272	explorer.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\3F5D43765B9861EF7FB6934E4F3BC696.exe
"C:\Users\Admin\AppData\Local\Temp\3F5D43765B9861EF7FB6934E4F3BC696.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:580

C:\Windows\syswow64\explorer.exe
"C:\Windows\syswow64\explorer.exe"
2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:272

C:\Windows\syswow64\svchost.exe
-k netsvcs
3⤵
PID:1668

C:\Windows\syswow64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
3⤵
- Interacts with shadow copies
PID:1600

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:896

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/272-55-0x0000000000000000-mapping.dmp

Download
memory/272-59-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/272-60-0x0000000000080000-0x00000000000A5000-memory.dmp

Filesize
148KB

Download
memory/580-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/580-56-0x0000000000220000-0x0000000000242000-memory.dmp

Filesize
136KB

Download
memory/580-57-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1600-62-0x0000000000000000-mapping.dmp

Download
memory/1668-61-0x0000000000000000-mapping.dmp

Download
memory/1668-63-0x0000000000080000-0x00000000000A5000-memory.dmp

Filesize
148KB

Download
memory/1668-65-0x0000000000080000-0x00000000000A5000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing