36d84dcb300d9424770b8200a1194311a37ec21872777b42951bd62b3fbe3621

Resubmissions

11-02-2023 10:14

230211-l9x16sfa2s 10

Analysis

max time kernel
499s
max time network
503s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11-02-2023 10:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe
Size

2.9MB
MD5

df0b88dafe7a65295f99e69a67db9e1b
SHA1

db3163a09eb33ff4370ad162a05f4b2584a20456
SHA256

f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429
SHA512

2206969d222882dd8b7e3e5671311462266277d699e08e3016a7b3781b17390e8dd11956d8aaecae996a2c16227d7b2390eb84b9b8df26e39ffe8f38d5b76fbd
SSDEEP

49152:cDVwASOLGtlqrRIU6i9+vazNqQlJZP1BMU2thA8mNtNCiJlrRUFcJ7HIPcLzkw5c:wm+GaNqqJJ12vlZol8cJ7rc3

Score

9^/10

ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
3160	vssadmin.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	5008	vssvc.exe
Token: SeRestorePrivilege	5008	vssvc.exe
Token: SeAuditPrivilege	5008	vssvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 3160	1640	f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe	79
PID 1640 wrote to memory of 3160	1640	f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe	79

C:\Users\Admin\AppData\Local\Temp\f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe
"C:\Users\Admin\AppData\Local\Temp\f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\System32\vssadmin.exe
  delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3160

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact