Analysis
-
max time kernel
141s -
max time network
67s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
09-03-2023 20:48
General
-
Target
2016-02-03-EITest-Angler-EK-payload-HydraCrypt.bin.exe
-
Size
164KB
-
MD5
08b304d01220f9de63244b4666621bba
-
SHA1
b7f9dd8ee3434b35fbb3395f69ff43fd5112a0c6
-
SHA256
afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e
-
SHA512
162cc0fb48615c67ce6e104ca462c41aba79bad0d5409e837b300cffc34a1c9bed63f603eee7091b93edfcd772d8ab1e180fcb3aae6b07fe24413b8505815ae9
-
SSDEEP
3072:fHynAdzu0t5GtE13lkAB9z3KJZ3fCI1AjZ7yXgpiqQp:fHKautY3TzaJZarjZeXgpn
Malware Config
Signatures
-
HydraCrypt
Relatively unsophisticated ransomware family based on leaked CrypBoss source code.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
-
Drops startup file 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Drops desktop.ini file(s) 64 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Interacts with shadow copies 2 TTPs 27 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 43 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2016-02-03-EITest-Angler-EK-payload-HydraCrypt.bin.exe"C:\Users\Admin\AppData\Local\Temp\2016-02-03-EITest-Angler-EK-payload-HydraCrypt.bin.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2016-02-03-EITest-Angler-EK-payload-HydraCrypt.bin.exeC:\Users\Admin\AppData\Local\Temp\2016-02-03-EITest-Angler-EK-payload-HydraCrypt.bin.exe2⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C net stop vss3⤵
-
C:\Windows\SysWOW64\net.exenet stop vss4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop vss5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /All3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Z: /All3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=Z: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Y: /All3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=Y: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=X: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=X: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=V: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=V: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=U: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=U: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=W: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=W: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=T: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=T: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=S: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=S: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=R: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=R: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Q: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=Q: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=P: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=P: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=O: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=O: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=N: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=N: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=M: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=M: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=L: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=L: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=K: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=K: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=J: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=J: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=I: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=I: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=H: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=H: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=G: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=G: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=F: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=F: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=E: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=E: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=D: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=D: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=C: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=C: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=B: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=B: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=A: /All3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /For=A: /All4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 79723⤵
- Program crash
-
-
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-8506824032135155593630421923-469705759-6137301091508827591212962404682656589"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-9475992671378339094-5832242751180845862-213370082747187124918212332495356582"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67B
MD5b4c2311fb5b666691d7109f5a7db2908
SHA1f4ce151c375ce4a822fe1a01c7b67e102a29f3ec
SHA2560847951242c7c44af41bd974264a5ff7d05f8f86eec606e9aa7019460bf321cd
SHA512e59dc17d8436908c968935197e583d0616870953534d9f62ae9caf043da092f9ed175df38d86979f9f1a105e6520b2814978d47e553043d5d76a29984b338152
-
Filesize
331B
MD5791eacbdd2a9cbb9ac3c55c3e5f6aff7
SHA190096e9836c45a83bc2efd0a71c1720006ecd006
SHA256ac8bcbef665f421aa8d4a2b1b2ad9cdc6e5d91ae29926d4e036354a0390e1675
SHA51260981e15d62e35053bfedc25553c33024b5c09d620acba9b3729fc6500c755ff3fd42dd39678c94f2432c538c0f2878bfeded41342fe924621af0a9319d60759
-
Filesize
1.1MB
MD5666355e96e7540a6f8f607c7767f89e2
SHA1fe4c5a4e4ac89797834e444c2f4a86c4351bc4f9
SHA256a7503edaed07bb5ce9fd1094f2fb268501d1c58ccfbe160369e59186c67c4e67
SHA512f08f46d66a6231c19875bfd43ba509b90e50aea6fb757a7ba5562b4eaa3ee1d021390fe82268afb685fa8076db5f7d24aa0b0b19c554107aae498a0b184ec908
-
Filesize
1KB
MD5029c1ba05a0e18977bd30d7b620e762b
SHA1a146f64b018f715a8b3572c26a0bbb6481f981d4
SHA256219073cd0fe343361ac0ece187171c50ad2cf9b8c814bb21e2f3be6c09a32ce5
SHA512653de12fab42742dc471c5e66738c585f1d035dc134e9d51b6670a9206f3ee0ce2d51d6765ec1b55e5baef7921c4c1beceea09fb8b7305b3f6a5371d83f73831
-
Filesize
915B
MD5ec8a491fe3884746490f92171b930633
SHA116776e53d50c90d5eeaa29185d8e3a9c7b631365
SHA256a94f02ee3488e12330293fd597a4cc8ca4602f3f3ee40b8d3c8240c8d90e97ca
SHA512e017290c8a90da94f38e7651305f12e93f4e13d87630a8cd7fd9342e513892707ecaa2f28ca6a4a608752184cb91acce146e02ba97734ca3f4833868131e3577
-
Filesize
915B
MD5ec8a491fe3884746490f92171b930633
SHA116776e53d50c90d5eeaa29185d8e3a9c7b631365
SHA256a94f02ee3488e12330293fd597a4cc8ca4602f3f3ee40b8d3c8240c8d90e97ca
SHA512e017290c8a90da94f38e7651305f12e93f4e13d87630a8cd7fd9342e513892707ecaa2f28ca6a4a608752184cb91acce146e02ba97734ca3f4833868131e3577
-
Filesize
20KB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
56KB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
5.5MB
-
Filesize
56KB
-
Filesize
5.5MB
-
Filesize
56KB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
56KB
-
Filesize
5.5MB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
1024KB