Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
29/03/2023, 19:26
Static task
static1
Behavioral task
behavioral1
Sample
bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe
Resource
win7-20230220-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe
- Size 720KB
- Sample230329-x5hapsbc7s
- SHA256 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b
- MD5 163e651162f292028ca9a8d7f1ed7340
- SHA1 a85ff9091f298ea2d6823a7b0053daa08b237423
- SHA512 f1cd02b07219d40d489b8000a92e20fca0c3e536a7dde25b98b7be0ce54a46349dcea9e66bef8f7fbd895ce7e5b22e3f3a46fbb9c7dcea4185b3937384f1649f
- SSDEEP 12288:A+2ZzbQ32UC1pC0q1oJn2OR9YA/SnHaetVkiIGjltRztp:A+4OECVCn2OR9r/kaetNIOtZ
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\AssertAdd.tiff bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe File opened (read-only) \??\S: bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe File opened (read-only) \??\V: bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe File opened (read-only) \??\Y: bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe File opened (read-only) \??\A: bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe File opened (read-only) \??\B: bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe File opened (read-only) \??\E: bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe File opened (read-only) \??\L: bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe File opened (read-only) \??\M: bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe File opened (read-only) \??\N: bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe File opened (read-only) \??\R: bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe File opened (read-only) \??\Q: bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe File opened (read-only) \??\D: bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe File opened (read-only) \??\F: bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe File opened (read-only) \??\G: bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe File opened (read-only) \??\I: bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe File opened (read-only) \??\J: bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe File opened (read-only) \??\K: bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe File opened (read-only) \??\O: bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe File opened (read-only) \??\U: bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe File opened (read-only) \??\W: bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe File opened (read-only) \??\H: bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe File opened (read-only) \??\T: bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe File opened (read-only) \??\X: bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe File opened (read-only) \??\Z: bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 5072 vssadmin.exe - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe Token: SeBackupPrivilege 1108 vssvc.exe Token: SeRestorePrivilege 1108 vssvc.exe Token: SeAuditPrivilege 1108 vssvc.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4424 wrote to memory of 2792 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 87 PID 4424 wrote to memory of 2792 4424 bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe 87 PID 2792 wrote to memory of 5072 2792 cmd.exe 89 PID 2792 wrote to memory of 5072 2792 cmd.exe 89 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe"C:\Users\Admin\AppData\Local\Temp\bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe"1⤵
- Modifies extensions of user files
- Checks computer location settings
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:5072
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1108