Resubmissions
11-02-2023 10:14
230211-l9x16sfa2s 10Analysis
-
max time kernel
99s -
max time network
102s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11-02-2023 10:14
Behavioral task
behavioral1
Sample
f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe
-
Size
2.9MB
-
MD5
df0b88dafe7a65295f99e69a67db9e1b
-
SHA1
db3163a09eb33ff4370ad162a05f4b2584a20456
-
SHA256
f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429
-
SHA512
2206969d222882dd8b7e3e5671311462266277d699e08e3016a7b3781b17390e8dd11956d8aaecae996a2c16227d7b2390eb84b9b8df26e39ffe8f38d5b76fbd
-
SSDEEP
49152:cDVwASOLGtlqrRIU6i9+vazNqQlJZP1BMU2thA8mNtNCiJlrRUFcJ7HIPcLzkw5c:wm+GaNqqJJ12vlZol8cJ7rc3
Score
9/10
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1812 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1400 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 1944 vssvc.exe Token: SeRestorePrivilege 1944 vssvc.exe Token: SeAuditPrivilege 1944 vssvc.exe Token: SeDebugPrivilege 1400 taskmgr.exe Token: 33 1504 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1504 AUDIODG.EXE Token: 33 1504 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1504 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 37 IoCs
pid Process 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe -
Suspicious use of SendNotifyMessage 37 IoCs
pid Process 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe 1400 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1752 wrote to memory of 1812 1752 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 26 PID 1752 wrote to memory of 1812 1752 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 26 PID 1752 wrote to memory of 1812 1752 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe"C:\Users\Admin\AppData\Local\Temp\f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\System32\vssadmin.exedelete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:1812
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1944
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1400
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1616
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x56c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1504