beef7e428f26c583dd92962cbe886f2e4286825a1637b7a427ce84139ab6307a

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
30-01-2023 11:37

Target

beef7e428f26c583dd92962cbe886f2e4286825a1637b7a427ce84139ab6307a.exe
Size

2.1MB
MD5

a0e99a1ba424a8f967b13021b42fce9f
SHA1

5e8e33d63d1bafa02084d018aab73a392fdce984
SHA256

beef7e428f26c583dd92962cbe886f2e4286825a1637b7a427ce84139ab6307a
SHA512

222b8e6c05402fa743646dc8039d71a6ef09eefcaeb6a18f877b5572cda73c31f718ffb1db5de02893cefaf77b25e597c953c15c55361f8d72e86790863f5dc2
SSDEEP

49152:AKdKdhwcjW7oPlIFP2a8cTPBn+zO1LH4Gh0LKUm:AKdQheoPOx8Mnb1

Score

9^/10

ransomware

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1432 vssadmin.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 1084 vssvc.exe
Token: SeRestorePrivilege 1084 vssvc.exe
Token: SeAuditPrivilege 1084 vssvc.exe

pid	process
1432	vssadmin.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

beef7e428f26c583dd92962cbe886f2e4286825a1637b7a427ce84139ab6307a.exe

description	pid	process	target process
PID 1544 wrote to memory of 1432	1544	beef7e428f26c583dd92962cbe886f2e4286825a1637b7a427ce84139ab6307a.exe	vssadmin.exe
PID 1544 wrote to memory of 1432	1544	beef7e428f26c583dd92962cbe886f2e4286825a1637b7a427ce84139ab6307a.exe	vssadmin.exe
PID 1544 wrote to memory of 1432	1544	beef7e428f26c583dd92962cbe886f2e4286825a1637b7a427ce84139ab6307a.exe	vssadmin.exe
PID 1544 wrote to memory of 1432	1544	beef7e428f26c583dd92962cbe886f2e4286825a1637b7a427ce84139ab6307a.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\beef7e428f26c583dd92962cbe886f2e4286825a1637b7a427ce84139ab6307a.exe
"C:\Users\Admin\AppData\Local\Temp\beef7e428f26c583dd92962cbe886f2e4286825a1637b7a427ce84139ab6307a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\SysWOW64\vssadmin.exe
delete shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:1432

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1084

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

memory/1432-55-0x0000000000000000-mapping.dmp

Download
memory/1544-54-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download