Overview

overview

10

Static

static

10

8ab7965415...ee.exe

windows7-x64

10

8ab7965415...ee.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    181s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-12-2022 13:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8ab79654152668be2c10be9cb17d941685e7733628dd7d38d6979516a75682ee.exe

  • Size

    218KB

  • MD5

    b8845a76e3942ff4d20ba4660ae926bb

  • SHA1

    eb90f945087c270a2ecc11753180ba4ecc270696

  • SHA256

    8ab79654152668be2c10be9cb17d941685e7733628dd7d38d6979516a75682ee

  • SHA512

    9e2eda3dfe3bbdf149707eefe67d889fc88e0aa45ae23023367a8914b8feabd1badb043dfb5f8301541d4489d31b79164380a5ac8031662156c639008c26c4fc

  • SSDEEP

    6144:aC61i972rJmciP98f2H64DQFu/U3buRKlemZ9DnGAe/Ix3Sd7+:aK972I/Gf2a4DQFu/U3buRKlemZ9DnG9

Score
10/10
zeppelinpersistenceransomware

Malware Config

Signatures

  • Detects Zeppelin payload 3 IoCs
  • Zeppelin Ransomware

    Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.

    ransomwarezeppelin
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8ab79654152668be2c10be9cb17d941685e7733628dd7d38d6979516a75682ee.exe
    "C:\Users\Admin\AppData\Local\Temp\8ab79654152668be2c10be9cb17d941685e7733628dd7d38d6979516a75682ee.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2208
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe" -start
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:316
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4416
        • C:\Windows\SysWOW64\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2264
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
        3⤵
          PID:3300
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
          3⤵
            PID:2448
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
            3⤵
              PID:3500
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
              3⤵
                PID:3840
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3752
                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                  wmic shadowcopy delete
                  4⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2956
              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
                "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe" -agent 0
                3⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                PID:5104
            • C:\Windows\SysWOW64\notepad.exe
              notepad.exe
              2⤵
                PID:224
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
                PID:4864

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\~temp001.bat
                Filesize

                521B

                MD5

                8a55e9dcda6d9b5b2a7c0ecaccf13068

                SHA1

                4804d35c80a15f7d63c3a143aa26778391537e2b

                SHA256

                db6cd89149e838122410fd50253ce2460444dea299d5c49b1a2f97b561b0d749

                SHA512

                c849477241bc950994dd85387f51be5e050604c7d46f10c4b9fb3bc7e308d658a08a7f3aa0b691eefb5fac2baaf7a5dd799bb159758b600e4f8d332329b44e9c

                Download Submit

              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
                Filesize

                218KB

                MD5

                b8845a76e3942ff4d20ba4660ae926bb

                SHA1

                eb90f945087c270a2ecc11753180ba4ecc270696

                SHA256

                8ab79654152668be2c10be9cb17d941685e7733628dd7d38d6979516a75682ee

                SHA512

                9e2eda3dfe3bbdf149707eefe67d889fc88e0aa45ae23023367a8914b8feabd1badb043dfb5f8301541d4489d31b79164380a5ac8031662156c639008c26c4fc

                Download Submit

              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
                Filesize

                218KB

                MD5

                b8845a76e3942ff4d20ba4660ae926bb

                SHA1

                eb90f945087c270a2ecc11753180ba4ecc270696

                SHA256

                8ab79654152668be2c10be9cb17d941685e7733628dd7d38d6979516a75682ee

                SHA512

                9e2eda3dfe3bbdf149707eefe67d889fc88e0aa45ae23023367a8914b8feabd1badb043dfb5f8301541d4489d31b79164380a5ac8031662156c639008c26c4fc

                Download Submit

              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
                Filesize

                218KB

                MD5

                b8845a76e3942ff4d20ba4660ae926bb

                SHA1

                eb90f945087c270a2ecc11753180ba4ecc270696

                SHA256

                8ab79654152668be2c10be9cb17d941685e7733628dd7d38d6979516a75682ee

                SHA512

                9e2eda3dfe3bbdf149707eefe67d889fc88e0aa45ae23023367a8914b8feabd1badb043dfb5f8301541d4489d31b79164380a5ac8031662156c639008c26c4fc

                Download Submit

              • memory/224-135-0x0000000000000000-mapping.dmp

                Download

              • memory/316-132-0x0000000000000000-mapping.dmp

                Download

              • memory/2264-146-0x0000000000000000-mapping.dmp

                Download

              • memory/2448-138-0x0000000000000000-mapping.dmp

                Download

              • memory/2956-145-0x0000000000000000-mapping.dmp

                Download

              • memory/3300-137-0x0000000000000000-mapping.dmp

                Download

              • memory/3500-139-0x0000000000000000-mapping.dmp

                Download

              • memory/3752-141-0x0000000000000000-mapping.dmp

                Download

              • memory/3840-140-0x0000000000000000-mapping.dmp

                Download

              • memory/4416-136-0x0000000000000000-mapping.dmp

                Download

              • memory/5104-142-0x0000000000000000-mapping.dmp

                Download