Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-12-2022 14:36
Static task
static1
Behavioral task
behavioral1
Sample
9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe
Resource
win10v2004-20221111-en
General
-
Target
9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe
-
Size
298KB
-
MD5
40cb01660e4b45213c35e997b94238a0
-
SHA1
8a1f0f62eede7cd183158567f9b78384074f5fed
-
SHA256
9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5
-
SHA512
305cedfe911fc108c33310a9954c368d9f3583f275d8cc002473bbb47294d7171b10854e2f513c589c4d17197e39dadcfc11c19bf9cf5573747651fefe5fd4e4
-
SSDEEP
6144:fMjokASLOMN9/wJP96/jdLnCd4C0+7s0Vlm2QV7wcNTLysyTXLI/dc46xPy3cYsF:nkAqOi94x96Rjw4C02silwNTLxyTX01a
Malware Config
Extracted
pony
http://gruzdom.ru/api/
Signatures
-
CrypVault
Ransomware family which makes encrypted files look like they have been quarantined by AV.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1620 1396 cmd.exe 32 -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 1532 bcdedit.exe 1400 bcdedit.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1516 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeImpersonatePrivilege 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe Token: SeTcbPrivilege 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe Token: SeChangeNotifyPrivilege 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe Token: SeCreateTokenPrivilege 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe Token: SeBackupPrivilege 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe Token: SeRestorePrivilege 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe Token: SeIncreaseQuotaPrivilege 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe Token: SeAssignPrimaryTokenPrivilege 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe Token: SeIncreaseQuotaPrivilege 636 WMIC.exe Token: SeSecurityPrivilege 636 WMIC.exe Token: SeTakeOwnershipPrivilege 636 WMIC.exe Token: SeLoadDriverPrivilege 636 WMIC.exe Token: SeSystemProfilePrivilege 636 WMIC.exe Token: SeSystemtimePrivilege 636 WMIC.exe Token: SeProfSingleProcessPrivilege 636 WMIC.exe Token: SeIncBasePriorityPrivilege 636 WMIC.exe Token: SeCreatePagefilePrivilege 636 WMIC.exe Token: SeBackupPrivilege 636 WMIC.exe Token: SeRestorePrivilege 636 WMIC.exe Token: SeShutdownPrivilege 636 WMIC.exe Token: SeDebugPrivilege 636 WMIC.exe Token: SeSystemEnvironmentPrivilege 636 WMIC.exe Token: SeRemoteShutdownPrivilege 636 WMIC.exe Token: SeUndockPrivilege 636 WMIC.exe Token: SeManageVolumePrivilege 636 WMIC.exe Token: 33 636 WMIC.exe Token: 34 636 WMIC.exe Token: 35 636 WMIC.exe Token: SeIncreaseQuotaPrivilege 636 WMIC.exe Token: SeSecurityPrivilege 636 WMIC.exe Token: SeTakeOwnershipPrivilege 636 WMIC.exe Token: SeLoadDriverPrivilege 636 WMIC.exe Token: SeSystemProfilePrivilege 636 WMIC.exe Token: SeSystemtimePrivilege 636 WMIC.exe Token: SeProfSingleProcessPrivilege 636 WMIC.exe Token: SeIncBasePriorityPrivilege 636 WMIC.exe Token: SeCreatePagefilePrivilege 636 WMIC.exe Token: SeBackupPrivilege 636 WMIC.exe Token: SeRestorePrivilege 636 WMIC.exe Token: SeShutdownPrivilege 636 WMIC.exe Token: SeDebugPrivilege 636 WMIC.exe Token: SeSystemEnvironmentPrivilege 636 WMIC.exe Token: SeRemoteShutdownPrivilege 636 WMIC.exe Token: SeUndockPrivilege 636 WMIC.exe Token: SeManageVolumePrivilege 636 WMIC.exe Token: 33 636 WMIC.exe Token: 34 636 WMIC.exe Token: 35 636 WMIC.exe Token: SeBackupPrivilege 940 vssvc.exe Token: SeRestorePrivilege 940 vssvc.exe Token: SeAuditPrivilege 940 vssvc.exe Token: SeImpersonatePrivilege 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe Token: SeTcbPrivilege 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe Token: SeChangeNotifyPrivilege 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe Token: SeCreateTokenPrivilege 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe Token: SeBackupPrivilege 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe Token: SeRestorePrivilege 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe Token: SeIncreaseQuotaPrivilege 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe Token: SeAssignPrimaryTokenPrivilege 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe Token: SeImpersonatePrivilege 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe Token: SeTcbPrivilege 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe Token: SeChangeNotifyPrivilege 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe Token: SeCreateTokenPrivilege 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe Token: SeBackupPrivilege 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1824 wrote to memory of 2020 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe 27 PID 1824 wrote to memory of 2020 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe 27 PID 1824 wrote to memory of 2020 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe 27 PID 1824 wrote to memory of 2020 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe 27 PID 1824 wrote to memory of 636 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe 29 PID 1824 wrote to memory of 636 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe 29 PID 1824 wrote to memory of 636 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe 29 PID 1824 wrote to memory of 636 1824 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe 29 PID 1620 wrote to memory of 1516 1620 cmd.exe 35 PID 1620 wrote to memory of 1516 1620 cmd.exe 35 PID 1620 wrote to memory of 1516 1620 cmd.exe 35 PID 1620 wrote to memory of 1532 1620 cmd.exe 38 PID 1620 wrote to memory of 1532 1620 cmd.exe 38 PID 1620 wrote to memory of 1532 1620 cmd.exe 38 PID 1620 wrote to memory of 1400 1620 cmd.exe 39 PID 1620 wrote to memory of 1400 1620 cmd.exe 39 PID 1620 wrote to memory of 1400 1620 cmd.exe 39 -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe"C:\Users\Admin\AppData\Local\Temp\9ed9ed487238d528d158d25f1a6189aa9fbe37f5bba5e40e033e0b0a786119d5.exe"1⤵
- Drops startup file
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:1824 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\VAULT.hta"2⤵
- Modifies Internet Explorer settings
PID:2020
-
-
C:\Windows\SysWOW64\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" process call create "cmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:636
-
-
C:\Windows\system32\cmd.execmd.exe /c vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:1516
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no2⤵
- Modifies boot configuration data using bcdedit
PID:1532
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures2⤵
- Modifies boot configuration data using bcdedit
PID:1400
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:940
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD51cf60361078e1c2f1219d27c4b3e760c
SHA108d350d205da687672b13e22b253932dd1708e75
SHA256c2d9c1bd8bb434dffd5ebbd0e8020ee73123f2e8134b19cbde4b6458f0d05a43
SHA51290f973c08c663dc7ca8575196ca2d6939bbeb9e1943268e8c8bae3b5cd895e85f654726924c86a0f1ffca4830f05c75ac6e80b44d4adeff345e9ff2cacaacccb