Analysis
-
max time kernel
114s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
23-12-2022 01:05
General
-
Target
931cab7fbc0eb2bbc5768f8abdcc029cef76aff98540d9f5214786dccdb6a224 (1).exe
-
Size
225KB
-
MD5
e75c4033f31862d8e71afe87620e2cce
-
SHA1
ff5095b2501fd9beee4fbe0f2a17a3151b540476
-
SHA256
931cab7fbc0eb2bbc5768f8abdcc029cef76aff98540d9f5214786dccdb6a224
-
SHA512
00210ec5079aa9adbe594b009ec0f6f866295fb4191dc55c4214cb876e88bfc81aa41701dfa7c7b4964363fded98d78d1b0361b78c62a80bea07dad52f7ce5f0
-
SSDEEP
6144:xQJmXLQwAhWUkJ0kfV50DErCMxgTw7ozFD254W:xeeLQwAi07DKGcopfW
Malware Config
Extracted
C:\README.html
us:<br><strong><br>email:[email protected]<br>email:[email protected]<br></strong><br><br>9C6K/FYOguQq6RjqcEyb3TDkZQg/REByD7yqlxZA8A3qtR+7lBBBsFHvxWtafTJ2
Extracted
C:\Users\Admin\AppData\Local\Temp\2015343831972527219.hta
email:[email protected]
email:[email protected]
Signatures
-
Venus
Venus is a ransomware first seen in 2022.
-
Venus Ransomware 5 IoCs
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
-
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Modifies extensions of user files 26 IoCs
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops desktop.ini file(s) 34 IoCs
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 1 IoCs
-
Modifies registry class 5 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 53 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 28 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\931cab7fbc0eb2bbc5768f8abdcc029cef76aff98540d9f5214786dccdb6a224 (1).exe"C:\Users\Admin\AppData\Local\Temp\931cab7fbc0eb2bbc5768f8abdcc029cef76aff98540d9f5214786dccdb6a224 (1).exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\931cab7fbc0eb2bbc5768f8abdcc029cef76aff98540d9f5214786dccdb6a224 (1).exe"C:\Windows\931cab7fbc0eb2bbc5768f8abdcc029cef76aff98540d9f5214786dccdb6a224 (1).exe" g g g o n e1232⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe/C netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\System32\cmd.exe/C taskkill /F /IM msftesql.exe /IM sqlagent.exe /IM sqlbrowser.exe /IM sqlservr.exe /IM sqlwriter.exe /IM oracle.exe /IM ocssd.exe /IM dbsnmp.exe /IM synctime.exe /IM mydesktopqos.exe /IM agntsvc.exe /IM isqlplussvc.exe /IM xfssvccon.exe /IM mydesktopservice.exe /IM ocautoupds.exe /IM agntsvc.exe /IM agntsvc.exe /IM agntsvc.exe /IM encsvc.exe /IM firefoxconfig.exe /IM tbirdconfig.exe /IM ocomm.exe /IM mysqld.exe /IM mysqld-nt.exe /IM mysqld-opt.exe /IM dbeng50.exe /IM sqbcoreservice.exe /IM excel.exe /IM infopath.exe /IM msaccess.exe /IM mspub.exe /IM onenote.exe /IM outlook.exe /IM powerpnt.exe /IM sqlservr.exe /IM thebat64.exe /IM thunderbird.exe /IM winword.exe /IM wordpad.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msftesql.exe /IM sqlagent.exe /IM sqlbrowser.exe /IM sqlservr.exe /IM sqlwriter.exe /IM oracle.exe /IM ocssd.exe /IM dbsnmp.exe /IM synctime.exe /IM mydesktopqos.exe /IM agntsvc.exe /IM isqlplussvc.exe /IM xfssvccon.exe /IM mydesktopservice.exe /IM ocautoupds.exe /IM agntsvc.exe /IM agntsvc.exe /IM agntsvc.exe /IM encsvc.exe /IM firefoxconfig.exe /IM tbirdconfig.exe /IM ocomm.exe /IM mysqld.exe /IM mysqld-nt.exe /IM mysqld-opt.exe /IM dbeng50.exe /IM sqbcoreservice.exe /IM excel.exe /IM infopath.exe /IM msaccess.exe /IM mspub.exe /IM onenote.exe /IM outlook.exe /IM powerpnt.exe /IM sqlservr.exe /IM thebat64.exe /IM thunderbird.exe /IM winword.exe /IM wordpad.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exe/C wbadmin delete catalog -quiet && vssadmin.exe delete shadows /all /quiet && bcdedit.exe /set {current} nx AlwaysOff && wmic SHADOWCOPY DELETE3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
-
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {current} nx AlwaysOff4⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\System32\Wbem\WMIC.exewmic SHADOWCOPY DELETE4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\2015343831972527219.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\System32\cmd.exe/c ping localhost -n 3 > nul & del C:\Users\Admin\AppData\Local\Temp\931cab7fbc0eb2bbc5768f8abdcc029cef76aff98540d9f5214786dccdb6a224 (1).exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping localhost -n 33⤵
- Runs ping.exe
-
-
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50089e9df914529756c04019714de5e34
SHA10a940de2bf6eb5e5194f733f70604dffa41087ce
SHA2566fc68341673e7ac45c14d9830a00777a4d363c6d62b25e493db5165453df9802
SHA5122389372375e6d94fb09634387ee70cb17d777b66da9aee727fe7f8da6c07acdb40512665487ede98d74cb019e4ec2676cd929b2c2183f03323993e0c9ffbe175
-
Filesize
225KB
MD5e75c4033f31862d8e71afe87620e2cce
SHA1ff5095b2501fd9beee4fbe0f2a17a3151b540476
SHA256931cab7fbc0eb2bbc5768f8abdcc029cef76aff98540d9f5214786dccdb6a224
SHA51200210ec5079aa9adbe594b009ec0f6f866295fb4191dc55c4214cb876e88bfc81aa41701dfa7c7b4964363fded98d78d1b0361b78c62a80bea07dad52f7ce5f0
-
Filesize
225KB
MD5e75c4033f31862d8e71afe87620e2cce
SHA1ff5095b2501fd9beee4fbe0f2a17a3151b540476
SHA256931cab7fbc0eb2bbc5768f8abdcc029cef76aff98540d9f5214786dccdb6a224
SHA51200210ec5079aa9adbe594b009ec0f6f866295fb4191dc55c4214cb876e88bfc81aa41701dfa7c7b4964363fded98d78d1b0361b78c62a80bea07dad52f7ce5f0
-
-
-
-
Filesize
248KB
-
-
-
-
-
-
Filesize
248KB
-
Filesize
248KB
-
-
-
-
-