Overview

overview

10

Static

static

10

4.exe

windows7-x64

10

4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    22-01-2023 19:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4.exe

  • Size

    211KB

  • MD5

    8f43f1fddbcf5409408eb618a981b23b

  • SHA1

    3ff15167aa71fc29c7f3ee17fc5f482d8ecceaf2

  • SHA256

    6656c50ffbdc59ce71b93474f43270dfeb42b57451724c25fa26f5bbf532e449

  • SHA512

    3a6bca15442233f9b36e51ea984353925d43ac17326742ad8a562542ca20e99da0477b583b8cc415eb8ab09b306a6b903e7ee1d79137487312ab5327f8ac2387

  • SSDEEP

    6144:+ia1gMH2EXtAup5Qnqn64DQFu/U3buRKlemZ9DnGAe+hsOn+8:+IMHxGe5Qb4DQFu/U3buRKlemZ9DnGAz

Score
10/10
zeppelinpersistenceransomware

Malware Config

Signatures

  • Detects Zeppelin payload 5 IoCs
  • Zeppelin Ransomware

    Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.

    ransomwarezeppelin
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4.exe
    "C:\Users\Admin\AppData\Local\Temp\4.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2000
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe" -start
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:1804
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1288
        • C:\Windows\SysWOW64\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1264
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
        3⤵
          PID:972
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
          3⤵
            PID:1620
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
            3⤵
              PID:2044
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1060
              • C:\Windows\SysWOW64\vssadmin.exe
                vssadmin delete shadows /all /quiet
                4⤵
                • Interacts with shadow copies
                PID:1600
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2020
              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                wmic shadowcopy delete
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1168
              • C:\Windows\SysWOW64\vssadmin.exe
                vssadmin delete shadows /all /quiet
                4⤵
                • Interacts with shadow copies
                PID:1300
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
              "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe" -agent 0
              3⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              PID:1588
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:976

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
          Filesize

          2KB

          MD5

          32db96b37f2eae8b4a5ea57eab7a06a5

          SHA1

          5c9452a956b990092a63df3149bd30f18828ebf9

          SHA256

          f1a4ba37c974965555658c88ce6a0e2085d8a51614393d537aca65c46e09d09e

          SHA512

          d7097cd356d07b7df806d7e0e6b5c832c0b60b0bbbffe354c3e7cf89c81b5bdb7672de9b4da2bf2ae4499e2bad95f2ff0ca7d7f28c8df767dc07c367a9759d27

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_8AE57F9FAAC778EA4099F469BEEE4C46
          Filesize

          472B

          MD5

          2b31673c5aec0f1f947b38be3c240ea7

          SHA1

          e315c9ab07e0163e096e8b04429ab18a1592889c

          SHA256

          19cd82739b40d6fb3496f711b2e8cb8d2c1dca9f9b0379dc4976358bcd007c34

          SHA512

          5a6df805b6c3637a766f5f049a53b308bb5fc26132667439cd5e00929fe7688d2b21e7608f00201bc2d61f6908eedc2dc7037d59cbf4d27e6c64a462ee0f59de

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
          Filesize

          61KB

          MD5

          fc4666cbca561e864e7fdf883a9e6661

          SHA1

          2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

          SHA256

          10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

          SHA512

          c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
          Filesize

          1KB

          MD5

          87975cbd581677a6d5cd26114617fd3f

          SHA1

          419007e489475e1a31e6200d1137d013b80a35e6

          SHA256

          dc6f87cc6bf6c82609944c30dfa67249c8cbce298a968cf03e791c62c9ec25c2

          SHA512

          1bc31a114308b5773138a10db665409fe542eb47f4d4529ad901c64d133dfa8e41f638d57d253ca5a4155461cc847a7e284f2c43b6c3807ce37ec476df5aed57

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
          Filesize

          484B

          MD5

          a00b0da43b7ac75b9dd4d837604e805b

          SHA1

          c87ced381b00a4f1f230fb0c20f255797f945106

          SHA256

          d8fb4a861d5e5617a5ecb8c4b59b99b58d1333692155ebec95cfc138960cbc87

          SHA512

          0aa10d53b121f33387210d739811e5ca67958f2fccd15c8e955d58368fb0f3cbff15d1d3e577b3b27d0b6850c9a2dce3877a44859aafa694b5c1f763fe401128

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_8AE57F9FAAC778EA4099F469BEEE4C46
          Filesize

          488B

          MD5

          3ada500161edeff390b2e3705d033ec5

          SHA1

          f75456e1ec5ac0203abcb743c855ae8a34df51ff

          SHA256

          b6b66410783eb5a30ba0cd2e451c8f0d0571fa9a8802ea01457bc26ddb85cf4e

          SHA512

          66f5d0760be1856b7b0b397bc818ba737554c6823d2930bbda06189e41e73d94d410c0438c02a8666976f655d63f8cdab3397905d2c310d2e2370ab877913707

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          6eadb3b7230e88bcc3e408bc70e7c805

          SHA1

          9d4748fafaeafd5b2f7a0baf93f8ead2ac0612c4

          SHA256

          f27f08e483b4cb7e01e8a326fded96ac0cd3be8a9864a0476fb270f5a199283b

          SHA512

          692312996b0debeb5674c76eea1c06013fb7d5012384f41efd85280f0807abe9dbdf05c6697697a86bfb4834a3ee03210465aca7c9ff55520df4363e038a302e

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
          Filesize

          482B

          MD5

          663c764f5335811f8d585dc71309924b

          SHA1

          029f5b7bbc20329e17ceaf227c95915d794d2940

          SHA256

          25260d45a1cb3b45a20dbb2e725dbd6ee754f1f791fcb311844d12eaf16e5f61

          SHA512

          fe3346c1987a7645bbb1027615c69cd27a3e6a7676980375863315f39dfb82c04a873392b028d0f3a86769c19a08180e3ad9a61916c434480bb394d88cd479fe

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IV8L6YIU\D11NA2RX.htm
          Filesize

          18KB

          MD5

          8615e70875c2cc0b9db16027b9adf11d

          SHA1

          4ed62cf405311c0ff562a3c59334a15ddc4f1bf9

          SHA256

          da96949ba6b0567343f144486505c8c8fa1d892fd88c9cbc3ef3d751a570724d

          SHA512

          cd9dfc88dc2af9438b7d6b618d1b62029b3bdf739fc4daa5b37397afd12c4528561b3bf2fc3f3f2adf3fd1f582d5524332441fd30248fcd078e41aa91e17cb73

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PFZC0YBM\TVDTNC6N.htm
          Filesize

          184B

          MD5

          b1cd7c031debba3a5c77b39b6791c1a7

          SHA1

          e5d91e14e9c685b06f00e550d9e189deb2075f76

          SHA256

          57ba053f075e0b80f747f3102ed985687c16a8754d109e7c4d33633269a36aaa

          SHA512

          d2bbefdc1effb52a38964c4cec5990a5a226248eca36f99e446c0c5704436f666bf1cb514e73b8991411d497d3325ecc646cbd5065c364e92ab6b9c5f1ad4a72

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\~temp001.bat
          Filesize

          404B

          MD5

          78215698f8f9dc7941c9c287642bd02c

          SHA1

          633cd0a6c76f080cdb6e0c98034b0b5dd7283a47

          SHA256

          dc94e21e80522b2cee097064c31a7720d70a02d0c55f290d59030fd0c995cac5

          SHA512

          c0a05f8cc400855c40b8e8eb3e7f027b06553cc592eb2ab6ad0a8c33ed2d196c7eda358977edc3f34ce1fdbff30efe288725eb10ea463e622ee9eb8085e48f7d

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
          Filesize

          211KB

          MD5

          8f43f1fddbcf5409408eb618a981b23b

          SHA1

          3ff15167aa71fc29c7f3ee17fc5f482d8ecceaf2

          SHA256

          6656c50ffbdc59ce71b93474f43270dfeb42b57451724c25fa26f5bbf532e449

          SHA512

          3a6bca15442233f9b36e51ea984353925d43ac17326742ad8a562542ca20e99da0477b583b8cc415eb8ab09b306a6b903e7ee1d79137487312ab5327f8ac2387

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
          Filesize

          211KB

          MD5

          8f43f1fddbcf5409408eb618a981b23b

          SHA1

          3ff15167aa71fc29c7f3ee17fc5f482d8ecceaf2

          SHA256

          6656c50ffbdc59ce71b93474f43270dfeb42b57451724c25fa26f5bbf532e449

          SHA512

          3a6bca15442233f9b36e51ea984353925d43ac17326742ad8a562542ca20e99da0477b583b8cc415eb8ab09b306a6b903e7ee1d79137487312ab5327f8ac2387

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
          Filesize

          211KB

          MD5

          8f43f1fddbcf5409408eb618a981b23b

          SHA1

          3ff15167aa71fc29c7f3ee17fc5f482d8ecceaf2

          SHA256

          6656c50ffbdc59ce71b93474f43270dfeb42b57451724c25fa26f5bbf532e449

          SHA512

          3a6bca15442233f9b36e51ea984353925d43ac17326742ad8a562542ca20e99da0477b583b8cc415eb8ab09b306a6b903e7ee1d79137487312ab5327f8ac2387

          Download Submit

        • \Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
          Filesize

          211KB

          MD5

          8f43f1fddbcf5409408eb618a981b23b

          SHA1

          3ff15167aa71fc29c7f3ee17fc5f482d8ecceaf2

          SHA256

          6656c50ffbdc59ce71b93474f43270dfeb42b57451724c25fa26f5bbf532e449

          SHA512

          3a6bca15442233f9b36e51ea984353925d43ac17326742ad8a562542ca20e99da0477b583b8cc415eb8ab09b306a6b903e7ee1d79137487312ab5327f8ac2387

          Download Submit

        • \Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
          Filesize

          211KB

          MD5

          8f43f1fddbcf5409408eb618a981b23b

          SHA1

          3ff15167aa71fc29c7f3ee17fc5f482d8ecceaf2

          SHA256

          6656c50ffbdc59ce71b93474f43270dfeb42b57451724c25fa26f5bbf532e449

          SHA512

          3a6bca15442233f9b36e51ea984353925d43ac17326742ad8a562542ca20e99da0477b583b8cc415eb8ab09b306a6b903e7ee1d79137487312ab5327f8ac2387

          Download Submit

        • memory/2000-54-0x0000000075D11000-0x0000000075D13000-memory.dmp

          Filesize

          8KB

          Download