5a805633a81b70c478b164a6057d5df41af974626620d9afb1b1a35df73a3730

Analysis

max time kernel
81s
max time network
87s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2023 14:19

Target

f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe
Size

2.9MB
MD5

df0b88dafe7a65295f99e69a67db9e1b
SHA1

db3163a09eb33ff4370ad162a05f4b2584a20456
SHA256

f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429
SHA512

2206969d222882dd8b7e3e5671311462266277d699e08e3016a7b3781b17390e8dd11956d8aaecae996a2c16227d7b2390eb84b9b8df26e39ffe8f38d5b76fbd
SSDEEP

49152:cDVwASOLGtlqrRIU6i9+vazNqQlJZP1BMU2thA8mNtNCiJlrRUFcJ7HIPcLzkw5c:wm+GaNqqJJ12vlZol8cJ7rc3

Score

9^/10

ransomware

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

508 vssadmin.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 4116 vssvc.exe
Token: SeRestorePrivilege 4116 vssvc.exe
Token: SeAuditPrivilege 4116 vssvc.exe

pid	process
508	vssadmin.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe

description	pid	process	target process
PID 4892 wrote to memory of 508	4892	f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe	vssadmin.exe
PID 4892 wrote to memory of 508	4892	f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe
"C:\Users\Admin\AppData\Local\Temp\f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4892

C:\Windows\System32\vssadmin.exe
delete shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:508

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4116

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery