Overview

overview

8

Static

static

1

c5ef104253...bb.exe

windows7-x64

8

c5ef104253...bb.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    130s
  • max time network
    54s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    21-03-2023 14:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c5ef104253ed4c066104a184ab368630027831b627c043d63170ff8f89c6a2bb.exe

  • Size

    210KB

  • MD5

    f486b69dc261cbf3ffac231324015ebb

  • SHA1

    ee1fc0b7350559fac9c23f7d832bdf2760e80b03

  • SHA256

    c5ef104253ed4c066104a184ab368630027831b627c043d63170ff8f89c6a2bb

  • SHA512

    16a1d8c6a371506525c488355e799b2fd04173a4dd6e771e1fcddb380d8a4d16f1f5bd310858f3f151a9c860c3636712a63b536ca55bc2b63f03263f4e50f12b

  • SSDEEP

    3072:QV+V98GoDHlXb6hyhwOfFAc/ZICFzhb9wl/mjF5I6yAJKybo:LVPo76y5NAcB5x9wk1VJKybo

Score
8/10
ransomwarespywarestealer

Malware Config

Signatures

  • Modifies extensions of user files 5 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 46 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\c5ef104253ed4c066104a184ab368630027831b627c043d63170ff8f89c6a2bb.exe
    "C:\Users\Admin\AppData\Local\Temp\c5ef104253ed4c066104a184ab368630027831b627c043d63170ff8f89c6a2bb.exe"
    1⤵
    • Modifies extensions of user files
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1708
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{40530E52-D859-4288-8535-7A1E7BF38742}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:292
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{362F9380-A10B-4293-BDFE-E2ABDECA2DAF}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:328
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{362F9380-A10B-4293-BDFE-E2ABDECA2DAF}'" delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:108
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BD5FDCA8-7209-40FA-9A5C-CEDEDC37256E}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1628
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BD5FDCA8-7209-40FA-9A5C-CEDEDC37256E}'" delete
        3⤵
          PID:1808
      • C:\Windows\system32\cmd.exe
        cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{93FAE12C-833C-441A-939F-52258540534E}'" delete
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:824
        • C:\Windows\System32\wbem\WMIC.exe
          C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{93FAE12C-833C-441A-939F-52258540534E}'" delete
          3⤵
            PID:396
        • C:\Windows\system32\cmd.exe
          cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4AC7E78B-CB66-4825-B5F5-1F514EAB0111}'" delete
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1784
          • C:\Windows\System32\wbem\WMIC.exe
            C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4AC7E78B-CB66-4825-B5F5-1F514EAB0111}'" delete
            3⤵
              PID:1632
          • C:\Windows\system32\cmd.exe
            cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{68742572-A9EF-406D-8825-1474A4A3AE2F}'" delete
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:832
            • C:\Windows\System32\wbem\WMIC.exe
              C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{68742572-A9EF-406D-8825-1474A4A3AE2F}'" delete
              3⤵
                PID:1260
            • C:\Windows\system32\cmd.exe
              cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{46A7E154-E116-4937-9D32-DC8C7C02E8A8}'" delete
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1932
              • C:\Windows\System32\wbem\WMIC.exe
                C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{46A7E154-E116-4937-9D32-DC8C7C02E8A8}'" delete
                3⤵
                  PID:1880
              • C:\Windows\system32\cmd.exe
                cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{DE8D6635-6769-4349-B17F-DFC50B9CD9B0}'" delete
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1592
                • C:\Windows\System32\wbem\WMIC.exe
                  C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{DE8D6635-6769-4349-B17F-DFC50B9CD9B0}'" delete
                  3⤵
                    PID:1812
                • C:\Windows\system32\cmd.exe
                  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D8A2D3A5-A46A-4D2A-9520-2932D9ABB035}'" delete
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1144
                  • C:\Windows\System32\wbem\WMIC.exe
                    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D8A2D3A5-A46A-4D2A-9520-2932D9ABB035}'" delete
                    3⤵
                      PID:564
                  • C:\Windows\system32\cmd.exe
                    cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{86B65306-46B3-4B33-A700-490BDE2E46FC}'" delete
                    2⤵
                      PID:1624
                      • C:\Windows\System32\wbem\WMIC.exe
                        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{86B65306-46B3-4B33-A700-490BDE2E46FC}'" delete
                        3⤵
                          PID:820
                      • C:\Windows\system32\cmd.exe
                        cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7BF24B04-491E-47A4-A279-BD67AC36C7EF}'" delete
                        2⤵
                          PID:1872
                          • C:\Windows\System32\wbem\WMIC.exe
                            C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7BF24B04-491E-47A4-A279-BD67AC36C7EF}'" delete
                            3⤵
                              PID:1752
                          • C:\Windows\system32\cmd.exe
                            cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{93A01BCD-1CE1-4859-8D37-BA4FEA28BD2D}'" delete
                            2⤵
                              PID:1672
                              • C:\Windows\System32\wbem\WMIC.exe
                                C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{93A01BCD-1CE1-4859-8D37-BA4FEA28BD2D}'" delete
                                3⤵
                                  PID:948
                              • C:\Windows\system32\cmd.exe
                                cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3C8D665A-144E-455D-9C50-3B972749B177}'" delete
                                2⤵
                                  PID:1044
                                  • C:\Windows\System32\wbem\WMIC.exe
                                    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3C8D665A-144E-455D-9C50-3B972749B177}'" delete
                                    3⤵
                                      PID:752
                                  • C:\Windows\system32\cmd.exe
                                    cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{06A0C767-A751-4562-9A96-8A6BDBB5178D}'" delete
                                    2⤵
                                      PID:916
                                      • C:\Windows\System32\wbem\WMIC.exe
                                        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{06A0C767-A751-4562-9A96-8A6BDBB5178D}'" delete
                                        3⤵
                                          PID:1568
                                      • C:\Windows\system32\cmd.exe
                                        cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{94367333-C515-4BAD-8EDC-5D79B53C5D0E}'" delete
                                        2⤵
                                          PID:1564
                                          • C:\Windows\System32\wbem\WMIC.exe
                                            C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{94367333-C515-4BAD-8EDC-5D79B53C5D0E}'" delete
                                            3⤵
                                              PID:1880
                                          • C:\Windows\system32\cmd.exe
                                            cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AA386E9-758B-4161-A1B6-15ED24FC93BB}'" delete
                                            2⤵
                                              PID:1528
                                              • C:\Windows\System32\wbem\WMIC.exe
                                                C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AA386E9-758B-4161-A1B6-15ED24FC93BB}'" delete
                                                3⤵
                                                  PID:1704
                                              • C:\Windows\system32\cmd.exe
                                                cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BF94CE8D-CB56-45BC-9D93-B88CC180A09F}'" delete
                                                2⤵
                                                  PID:1500
                                                  • C:\Windows\System32\wbem\WMIC.exe
                                                    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BF94CE8D-CB56-45BC-9D93-B88CC180A09F}'" delete
                                                    3⤵
                                                      PID:1876
                                                  • C:\Windows\system32\cmd.exe
                                                    cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A6C9FDDD-2105-402F-B9BD-770535EDBE41}'" delete
                                                    2⤵
                                                      PID:2020
                                                      • C:\Windows\System32\wbem\WMIC.exe
                                                        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A6C9FDDD-2105-402F-B9BD-770535EDBE41}'" delete
                                                        3⤵
                                                          PID:848
                                                    • C:\Windows\system32\vssvc.exe
                                                      C:\Windows\system32\vssvc.exe
                                                      1⤵
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:1636
                                                    • C:\Windows\System32\wbem\WMIC.exe
                                                      C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{40530E52-D859-4288-8535-7A1E7BF38742}'" delete
                                                      1⤵
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:1464

                                                    Network

                                                    MITRE ATT&CK Enterprise v6

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\ProgramData\README.txt
                                                      Filesize

                                                      122B

                                                      MD5

                                                      818d78ec097f2a03ae2dafeb16e1de7f

                                                      SHA1

                                                      204ba20483435f1b6b4a8dea41c4e4f104adf59c

                                                      SHA256

                                                      9e930a6bbe9443c3683df6639f5007afd6f2213d8c0abeadd281fc5e8a59a8ae

                                                      SHA512

                                                      d28e3a81645f8541e2f5cd2d89f23c02dff12b6430dc6d47e9156ccd20d092ce9d91cf6b7ca68cab744752b7d42d4b71ae1679dc79f0cc1d73a91cbba5151396

                                                      Download Submit