Resubmissions
24-01-2023 13:50
230124-q5b1csca58 1024-01-2023 13:46
230124-q2y1qaca48 1024-11-2022 17:20
221124-vwk9wscd91 10Analysis
-
max time kernel
140s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-01-2023 13:46
Behavioral task
behavioral1
Sample
f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe
Resource
win10v2004-20220812-en
General
-
Target
f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe
-
Size
2.9MB
-
MD5
df0b88dafe7a65295f99e69a67db9e1b
-
SHA1
db3163a09eb33ff4370ad162a05f4b2584a20456
-
SHA256
f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429
-
SHA512
2206969d222882dd8b7e3e5671311462266277d699e08e3016a7b3781b17390e8dd11956d8aaecae996a2c16227d7b2390eb84b9b8df26e39ffe8f38d5b76fbd
-
SSDEEP
49152:cDVwASOLGtlqrRIU6i9+vazNqQlJZP1BMU2thA8mNtNCiJlrRUFcJ7HIPcLzkw5c:wm+GaNqqJJ12vlZol8cJ7rc3
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1640 vssadmin.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 3888 vssvc.exe Token: SeRestorePrivilege 3888 vssvc.exe Token: SeAuditPrivilege 3888 vssvc.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exedescription pid process target process PID 1768 wrote to memory of 1640 1768 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe vssadmin.exe PID 1768 wrote to memory of 1640 1768 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe"C:\Users\Admin\AppData\Local\Temp\f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\System32\vssadmin.exedelete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:1640
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3888