Analysis
-
max time kernel
101s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
22-12-2022 04:50
General
-
Target
fa57cf745ea986627cfeb9615038685304457812f262d3e20bd4ee0a70145bb3.exe
-
Size
225KB
-
MD5
f62590e838b1d13960abb6b363e03ed9
-
SHA1
66f706a7d39038964471e0a009a76e0f978fb075
-
SHA256
fa57cf745ea986627cfeb9615038685304457812f262d3e20bd4ee0a70145bb3
-
SHA512
7d372043b31cca8d6d73ecd386e08d720ec29fa02e6c01b099c70977e7bdbd06f2a2a8c44f1b813c1a4b67b12a37a51efcfc3776e8667ed216b25d2bf1d56556
-
SSDEEP
6144:IuC7JmXiQwAh6jkJwkNV50DEr9MxgTw7ozFD254W:IuCteiQwAjw1DDGcopfW
Malware Config
Extracted
C:\README.html
us:<br><strong><br>email:[email protected]<br>email:[email protected]<br></strong><br><br>7tHcfikjaWfTUUQi1kF4/IpRAHcm3O9U8KwEbX+hYTWWtdPCTp1j+amG/hwc/ff7
Extracted
C:\Users\Admin\AppData\Local\Temp\180596361972527219.hta
email:[email protected]
email:[email protected]
Signatures
-
Venus
Venus is a ransomware first seen in 2022.
-
Venus Ransomware 5 IoCs
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
-
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops desktop.ini file(s) 34 IoCs
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 1 IoCs
-
Modifies registry class 5 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 53 IoCs
-
Suspicious use of WriteProcessMemory 28 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa57cf745ea986627cfeb9615038685304457812f262d3e20bd4ee0a70145bb3.exe"C:\Users\Admin\AppData\Local\Temp\fa57cf745ea986627cfeb9615038685304457812f262d3e20bd4ee0a70145bb3.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\fa57cf745ea986627cfeb9615038685304457812f262d3e20bd4ee0a70145bb3.exe"C:\Windows\fa57cf745ea986627cfeb9615038685304457812f262d3e20bd4ee0a70145bb3.exe" g g g o n e1232⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe/C taskkill /F /IM msftesql.exe /IM sqlagent.exe /IM sqlbrowser.exe /IM sqlservr.exe /IM sqlwriter.exe /IM oracle.exe /IM ocssd.exe /IM dbsnmp.exe /IM synctime.exe /IM mydesktopqos.exe /IM agntsvc.exe /IM isqlplussvc.exe /IM xfssvccon.exe /IM mydesktopservice.exe /IM ocautoupds.exe /IM agntsvc.exe /IM agntsvc.exe /IM agntsvc.exe /IM encsvc.exe /IM firefoxconfig.exe /IM tbirdconfig.exe /IM ocomm.exe /IM mysqld.exe /IM mysqld-nt.exe /IM mysqld-opt.exe /IM dbeng50.exe /IM sqbcoreservice.exe /IM excel.exe /IM infopath.exe /IM msaccess.exe /IM mspub.exe /IM onenote.exe /IM outlook.exe /IM powerpnt.exe /IM sqlservr.exe /IM thebat64.exe /IM thunderbird.exe /IM winword.exe /IM wordpad.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msftesql.exe /IM sqlagent.exe /IM sqlbrowser.exe /IM sqlservr.exe /IM sqlwriter.exe /IM oracle.exe /IM ocssd.exe /IM dbsnmp.exe /IM synctime.exe /IM mydesktopqos.exe /IM agntsvc.exe /IM isqlplussvc.exe /IM xfssvccon.exe /IM mydesktopservice.exe /IM ocautoupds.exe /IM agntsvc.exe /IM agntsvc.exe /IM agntsvc.exe /IM encsvc.exe /IM firefoxconfig.exe /IM tbirdconfig.exe /IM ocomm.exe /IM mysqld.exe /IM mysqld-nt.exe /IM mysqld-opt.exe /IM dbeng50.exe /IM sqbcoreservice.exe /IM excel.exe /IM infopath.exe /IM msaccess.exe /IM mspub.exe /IM onenote.exe /IM outlook.exe /IM powerpnt.exe /IM sqlservr.exe /IM thebat64.exe /IM thunderbird.exe /IM winword.exe /IM wordpad.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exe/C netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\System32\cmd.exe/C wbadmin delete catalog -quiet && vssadmin.exe delete shadows /all /quiet && bcdedit.exe /set {current} nx AlwaysOff && wmic SHADOWCOPY DELETE3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {current} nx AlwaysOff4⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\System32\Wbem\WMIC.exewmic SHADOWCOPY DELETE4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\180596361972527219.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵
-
-
-
C:\Windows\System32\cmd.exe/c ping localhost -n 3 > nul & del C:\Users\Admin\AppData\Local\Temp\fa57cf745ea986627cfeb9615038685304457812f262d3e20bd4ee0a70145bb3.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping localhost -n 33⤵
- Runs ping.exe
-
-
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57bf5504493e7f57fc33f3a57a63661b0
SHA1624830040ff9c8856c9eefc6c34ecab242272d92
SHA2564af73b1d4a6eb3d84ad3119692b156763c8616c19d671632b8afeb90878f3285
SHA512abd07cd6eb2f4e7d93f7987eba0f9b18712db78a1e29c50456b871d9d91491328cd88846feaa712763ac558bc35081aa2535a046f99c61fad50462fbeb17cc0e
-
Filesize
225KB
MD5f62590e838b1d13960abb6b363e03ed9
SHA166f706a7d39038964471e0a009a76e0f978fb075
SHA256fa57cf745ea986627cfeb9615038685304457812f262d3e20bd4ee0a70145bb3
SHA5127d372043b31cca8d6d73ecd386e08d720ec29fa02e6c01b099c70977e7bdbd06f2a2a8c44f1b813c1a4b67b12a37a51efcfc3776e8667ed216b25d2bf1d56556
-
Filesize
225KB
MD5f62590e838b1d13960abb6b363e03ed9
SHA166f706a7d39038964471e0a009a76e0f978fb075
SHA256fa57cf745ea986627cfeb9615038685304457812f262d3e20bd4ee0a70145bb3
SHA5127d372043b31cca8d6d73ecd386e08d720ec29fa02e6c01b099c70977e7bdbd06f2a2a8c44f1b813c1a4b67b12a37a51efcfc3776e8667ed216b25d2bf1d56556
-
-
-
-
-
-
Filesize
248KB
-
-
-
Filesize
248KB
-
Filesize
248KB
-
-
-
-
-
-