Analysis
- max time kernel
43s - max time network
46s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system - submitted
23/12/2022, 14:36
Static task
static1
Behavioral task
behavioral1
Sample
3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe
Resource
win7-20220812-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
18 signatures
150 seconds
General
- Target 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe
- Size 319KB
- Sample221223-ryphjsbg4w
- SHA256 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e
- MD5 37db790ae1c5c9d514f0b21b2ee41eba
- SHA1 b82c08f43f11430773d313ee362ca0726bbafa24
- SHA512 79c8cfad6f27739cd567d2f49035ab37081d38677e9b0ac28942d4221a4327c9f44fc3deb31038543710d533369681c8a82561b97008e33dc6e3d5e5f2937c0f
- SSDEEP 6144:fMjokASLOMN9/wJP96/0ma0ZlDFWs9zAnmeDWB2hDukzinSiikKWfxCdvHnQSd2b:nkAqOi94x968mR/DDzBO82hpinSiikxp
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
pony
C2
-
http://gruzdom.ru/api/
Signatures
- CrypVault
Ransomware family which makes encrypted files look like they have been quarantined by AV.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 520 108 cmd.exe 32 - Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 552 bcdedit.exe 1632 bcdedit.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe - Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 704 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main mshta.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeImpersonatePrivilege 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeTcbPrivilege 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeChangeNotifyPrivilege 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeCreateTokenPrivilege 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeBackupPrivilege 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeRestorePrivilege 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeIncreaseQuotaPrivilege 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeAssignPrimaryTokenPrivilege 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeIncreaseQuotaPrivilege 688 WMIC.exe Token: SeSecurityPrivilege 688 WMIC.exe Token: SeTakeOwnershipPrivilege 688 WMIC.exe Token: SeLoadDriverPrivilege 688 WMIC.exe Token: SeSystemProfilePrivilege 688 WMIC.exe Token: SeSystemtimePrivilege 688 WMIC.exe Token: SeProfSingleProcessPrivilege 688 WMIC.exe Token: SeIncBasePriorityPrivilege 688 WMIC.exe Token: SeCreatePagefilePrivilege 688 WMIC.exe Token: SeBackupPrivilege 688 WMIC.exe Token: SeRestorePrivilege 688 WMIC.exe Token: SeShutdownPrivilege 688 WMIC.exe Token: SeDebugPrivilege 688 WMIC.exe Token: SeSystemEnvironmentPrivilege 688 WMIC.exe Token: SeRemoteShutdownPrivilege 688 WMIC.exe Token: SeUndockPrivilege 688 WMIC.exe Token: SeManageVolumePrivilege 688 WMIC.exe Token: 33 688 WMIC.exe Token: 34 688 WMIC.exe Token: 35 688 WMIC.exe Token: SeIncreaseQuotaPrivilege 688 WMIC.exe Token: SeSecurityPrivilege 688 WMIC.exe Token: SeTakeOwnershipPrivilege 688 WMIC.exe Token: SeLoadDriverPrivilege 688 WMIC.exe Token: SeSystemProfilePrivilege 688 WMIC.exe Token: SeSystemtimePrivilege 688 WMIC.exe Token: SeProfSingleProcessPrivilege 688 WMIC.exe Token: SeIncBasePriorityPrivilege 688 WMIC.exe Token: SeCreatePagefilePrivilege 688 WMIC.exe Token: SeBackupPrivilege 688 WMIC.exe Token: SeRestorePrivilege 688 WMIC.exe Token: SeShutdownPrivilege 688 WMIC.exe Token: SeDebugPrivilege 688 WMIC.exe Token: SeSystemEnvironmentPrivilege 688 WMIC.exe Token: SeRemoteShutdownPrivilege 688 WMIC.exe Token: SeUndockPrivilege 688 WMIC.exe Token: SeManageVolumePrivilege 688 WMIC.exe Token: 33 688 WMIC.exe Token: 34 688 WMIC.exe Token: 35 688 WMIC.exe Token: SeBackupPrivilege 1664 vssvc.exe Token: SeRestorePrivilege 1664 vssvc.exe Token: SeAuditPrivilege 1664 vssvc.exe Token: SeImpersonatePrivilege 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeTcbPrivilege 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeChangeNotifyPrivilege 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeCreateTokenPrivilege 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeBackupPrivilege 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeRestorePrivilege 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeIncreaseQuotaPrivilege 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeAssignPrimaryTokenPrivilege 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeImpersonatePrivilege 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeTcbPrivilege 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeChangeNotifyPrivilege 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeCreateTokenPrivilege 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeBackupPrivilege 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1756 wrote to memory of 1712 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe 27 PID 1756 wrote to memory of 1712 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe 27 PID 1756 wrote to memory of 1712 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe 27 PID 1756 wrote to memory of 1712 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe 27 PID 1756 wrote to memory of 688 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe 30 PID 1756 wrote to memory of 688 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe 30 PID 1756 wrote to memory of 688 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe 30 PID 1756 wrote to memory of 688 1756 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe 30 PID 520 wrote to memory of 704 520 cmd.exe 35 PID 520 wrote to memory of 704 520 cmd.exe 35 PID 520 wrote to memory of 704 520 cmd.exe 35 PID 520 wrote to memory of 552 520 cmd.exe 38 PID 520 wrote to memory of 552 520 cmd.exe 38 PID 520 wrote to memory of 552 520 cmd.exe 38 PID 520 wrote to memory of 1632 520 cmd.exe 39 PID 520 wrote to memory of 1632 520 cmd.exe 39 PID 520 wrote to memory of 1632 520 cmd.exe 39 - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe"C:\Users\Admin\AppData\Local\Temp\3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe"1⤵
- Drops startup file
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:1756 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\VAULT.hta"2⤵
- Modifies Internet Explorer settings
PID:1712
-
-
C:\Windows\SysWOW64\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" process call create "cmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:688
-
-
C:\Windows\system32\cmd.execmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:704
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no2⤵
- Modifies boot configuration data using bcdedit
PID:552
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:1632
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1664
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Desktop\VAULT.hta
- Size 4KB
- SHA256 c2d9c1bd8bb434dffd5ebbd0e8020ee73123f2e8134b19cbde4b6458f0d05a43
- MD5 1cf60361078e1c2f1219d27c4b3e760c
- SHA1 08d350d205da687672b13e22b253932dd1708e75
- SHA512 90f973c08c663dc7ca8575196ca2d6939bbeb9e1943268e8c8bae3b5cd895e85f654726924c86a0f1ffca4830f05c75ac6e80b44d4adeff345e9ff2cacaacccb
- SSDEEP 48:U07JxP1M1yWd2Y5eNqg20F3F1N0RA7in8WYfrhkg3y8YfJ+LbDVO4wzAR/4Ljj:HPCyU1Aj2642eeCEusub
- MD5 SHA1 SHA512 SSDEEP