Analysis
- max time kernel
121s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
23/12/2022, 14:36
Static task
static1
Behavioral task
behavioral1
Sample
3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe
Resource
win7-20220812-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
18 signatures
150 seconds
General
- Target 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe
- Size 319KB
- Sample221223-ryphjsbg4w
- SHA256 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e
- MD5 37db790ae1c5c9d514f0b21b2ee41eba
- SHA1 b82c08f43f11430773d313ee362ca0726bbafa24
- SHA512 79c8cfad6f27739cd567d2f49035ab37081d38677e9b0ac28942d4221a4327c9f44fc3deb31038543710d533369681c8a82561b97008e33dc6e3d5e5f2937c0f
- SSDEEP 6144:fMjokASLOMN9/wJP96/0ma0ZlDFWs9zAnmeDWB2hDukzinSiikKWfxCdvHnQSd2b:nkAqOi94x968mR/DDzBO82hpinSiikxp
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
pony
C2
-
http://gruzdom.ru/api/
Signatures
- CrypVault
Ransomware family which makes encrypted files look like they have been quarantined by AV.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2744 1296 cmd.exe 29 - Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 340 bcdedit.exe 308 bcdedit.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe - Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3660 vssadmin.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3936 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe 3936 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeImpersonatePrivilege 3936 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeTcbPrivilege 3936 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeChangeNotifyPrivilege 3936 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeCreateTokenPrivilege 3936 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeBackupPrivilege 3936 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeRestorePrivilege 3936 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeIncreaseQuotaPrivilege 3936 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeAssignPrimaryTokenPrivilege 3936 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeIncreaseQuotaPrivilege 512 WMIC.exe Token: SeSecurityPrivilege 512 WMIC.exe Token: SeTakeOwnershipPrivilege 512 WMIC.exe Token: SeLoadDriverPrivilege 512 WMIC.exe Token: SeSystemProfilePrivilege 512 WMIC.exe Token: SeSystemtimePrivilege 512 WMIC.exe Token: SeProfSingleProcessPrivilege 512 WMIC.exe Token: SeIncBasePriorityPrivilege 512 WMIC.exe Token: SeCreatePagefilePrivilege 512 WMIC.exe Token: SeBackupPrivilege 512 WMIC.exe Token: SeRestorePrivilege 512 WMIC.exe Token: SeShutdownPrivilege 512 WMIC.exe Token: SeDebugPrivilege 512 WMIC.exe Token: SeSystemEnvironmentPrivilege 512 WMIC.exe Token: SeRemoteShutdownPrivilege 512 WMIC.exe Token: SeUndockPrivilege 512 WMIC.exe Token: SeManageVolumePrivilege 512 WMIC.exe Token: 33 512 WMIC.exe Token: 34 512 WMIC.exe Token: 35 512 WMIC.exe Token: 36 512 WMIC.exe Token: SeIncreaseQuotaPrivilege 512 WMIC.exe Token: SeSecurityPrivilege 512 WMIC.exe Token: SeTakeOwnershipPrivilege 512 WMIC.exe Token: SeLoadDriverPrivilege 512 WMIC.exe Token: SeSystemProfilePrivilege 512 WMIC.exe Token: SeSystemtimePrivilege 512 WMIC.exe Token: SeProfSingleProcessPrivilege 512 WMIC.exe Token: SeIncBasePriorityPrivilege 512 WMIC.exe Token: SeCreatePagefilePrivilege 512 WMIC.exe Token: SeBackupPrivilege 512 WMIC.exe Token: SeRestorePrivilege 512 WMIC.exe Token: SeShutdownPrivilege 512 WMIC.exe Token: SeDebugPrivilege 512 WMIC.exe Token: SeSystemEnvironmentPrivilege 512 WMIC.exe Token: SeRemoteShutdownPrivilege 512 WMIC.exe Token: SeUndockPrivilege 512 WMIC.exe Token: SeManageVolumePrivilege 512 WMIC.exe Token: 33 512 WMIC.exe Token: 34 512 WMIC.exe Token: 35 512 WMIC.exe Token: 36 512 WMIC.exe Token: SeBackupPrivilege 4120 vssvc.exe Token: SeRestorePrivilege 4120 vssvc.exe Token: SeAuditPrivilege 4120 vssvc.exe Token: SeImpersonatePrivilege 3936 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeTcbPrivilege 3936 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeChangeNotifyPrivilege 3936 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeCreateTokenPrivilege 3936 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeBackupPrivilege 3936 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeRestorePrivilege 3936 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeIncreaseQuotaPrivilege 3936 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeAssignPrimaryTokenPrivilege 3936 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeImpersonatePrivilege 3936 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeTcbPrivilege 3936 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe Token: SeChangeNotifyPrivilege 3936 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3936 wrote to memory of 508 3936 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe 82 PID 3936 wrote to memory of 508 3936 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe 82 PID 3936 wrote to memory of 508 3936 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe 82 PID 3936 wrote to memory of 512 3936 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe 83 PID 3936 wrote to memory of 512 3936 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe 83 PID 3936 wrote to memory of 512 3936 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe 83 PID 2744 wrote to memory of 3660 2744 cmd.exe 87 PID 2744 wrote to memory of 3660 2744 cmd.exe 87 PID 2744 wrote to memory of 340 2744 cmd.exe 92 PID 2744 wrote to memory of 340 2744 cmd.exe 92 PID 2744 wrote to memory of 308 2744 cmd.exe 93 PID 2744 wrote to memory of 308 2744 cmd.exe 93 - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe"C:\Users\Admin\AppData\Local\Temp\3f9bfbb9ac8cde1e7038b66d961dd149be2f86348c0a30d4455cffed6dc1614e.exe"1⤵
- Checks computer location settings
- Drops startup file
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:3936 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\VAULT.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵PID:508
-
-
C:\Windows\SysWOW64\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" process call create "cmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:512
-
-
C:\Windows\system32\cmd.execmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:3660
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no2⤵
- Modifies boot configuration data using bcdedit
PID:340
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:308
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4120
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Desktop\VAULT.hta
- Size 4KB
- SHA256 c2d9c1bd8bb434dffd5ebbd0e8020ee73123f2e8134b19cbde4b6458f0d05a43
- MD5 1cf60361078e1c2f1219d27c4b3e760c
- SHA1 08d350d205da687672b13e22b253932dd1708e75
- SHA512 90f973c08c663dc7ca8575196ca2d6939bbeb9e1943268e8c8bae3b5cd895e85f654726924c86a0f1ffca4830f05c75ac6e80b44d4adeff345e9ff2cacaacccb
- SSDEEP 48:U07JxP1M1yWd2Y5eNqg20F3F1N0RA7in8WYfrhkg3y8YfJ+LbDVO4wzAR/4Ljj:HPCyU1Aj2642eeCEusub
- MD5 SHA1 SHA512 SSDEEP