Overview

overview

10

Static

static

3

c9b1665e58...b5.exe

windows7-x64

9

c9b1665e58...b5.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/05/2023, 18:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    c9b1665e58fe0bd5a47bac14d7f262fcb21a90775c97bd778288c21eaac7435b5.exe

  • Size

    518KB

  • MD5

    d03823a205919b6927f3fa3164be5ac5

  • SHA1

    409181132564166a62ee867321ebc07089e49085

  • SHA256

    c9b1665e58fe0bd5a47bac14d7f262fcb21a90775c97bd778288c21eaac7435b

  • SHA512

    b39a297dd63d9e52d9ccc50cdcb418a98d9e648a26af7a6fd31520f5299656e48dfd1b58174667a1b50410259cab62cffe9e8e549fb1fb3699150e22814204d2

  • SSDEEP

    12288:yh1Lk70TnvjcrT/6wla486fIcf4cA5eBRDpPKAha2v:Gk70TrcrRlH86Acf4cAEBdP

Score
10/10
evasionransomwaretrojan

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
    evasiontrojan
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies Windows Firewall 1 TTPs 2 IoCs
    evasion
  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • .NET Reactor proctector 34 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Drops desktop.ini file(s) 26 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\c9b1665e58fe0bd5a47bac14d7f262fcb21a90775c97bd778288c21eaac7435b5.exe
    "C:\Users\Admin\AppData\Local\Temp\c9b1665e58fe0bd5a47bac14d7f262fcb21a90775c97bd778288c21eaac7435b5.exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • Modifies extensions of user files
    • Checks computer location settings
    • Drops startup file
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\Admin\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:436
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\Admin\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F
        3⤵
        • Creates scheduled task(s)
        PID:2268
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\anvwnf4w\anvwnf4w.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3864
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC16.tmp" "c:\ProgramData\CSC2807E33C3EDF4A899AE39D86CF1DF944.TMP"
        3⤵
          PID:1768
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet
        2⤵
          PID:5072
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C wbadmin DELETE SYSTEMSTATEBACKUP
          2⤵
            PID:1888
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1944
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic shadowcopy delete
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2320
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
            2⤵
              PID:4084
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
              2⤵
                PID:4788
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C netsh advfirewall set currentprofile state off
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:2936
                • C:\Windows\SysWOW64\netsh.exe
                  netsh advfirewall set currentprofile state off
                  3⤵
                  • Modifies Windows Firewall
                  PID:4664
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
                2⤵
                  PID:1260
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C netsh firewall set opmode mode=disable
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4684
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh firewall set opmode mode=disable
                    3⤵
                    • Modifies Windows Firewall
                    PID:1468
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Get-ADComputer -filter * -Searchbase '%s' | foreach{ Invoke-GPUpdate -computer $_.name -force -RandomDelayInMinutes 0}"
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4204
              • C:\Windows\system32\vssvc.exe
                C:\Windows\system32\vssvc.exe
                1⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:3844

              Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\ProgramData\os1tzm54.exe
                      Filesize

                      28KB

                      MD5

                      f0a1fbdc996e2270064cbdcf448d320d

                      SHA1

                      e984fb125e46a6549f010e422336823e6a59772f

                      SHA256

                      69879475adcc67598616b2ae249f6bd2e835c1e0f574865f8b50c1799bd34a84

                      SHA512

                      8cda066b5c52bbbf28705a7d17f6fbb0ab47a1d954c2e51a7299a1b6df5335ed40047c9a6437e20c759c8023d95caf2e881b67ff43c47d8dd4c3a66a9a7727e2

                      Download Submit

                    • C:\ProgramData\winlogon.exe
                      Filesize

                      518KB

                      MD5

                      d03823a205919b6927f3fa3164be5ac5

                      SHA1

                      409181132564166a62ee867321ebc07089e49085

                      SHA256

                      c9b1665e58fe0bd5a47bac14d7f262fcb21a90775c97bd778288c21eaac7435b

                      SHA512

                      b39a297dd63d9e52d9ccc50cdcb418a98d9e648a26af7a6fd31520f5299656e48dfd1b58174667a1b50410259cab62cffe9e8e549fb1fb3699150e22814204d2

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\RESC16.tmp
                      Filesize

                      25KB

                      MD5

                      eccca156453da49f9b1366f7ea998c7c

                      SHA1

                      826a998e968f9364b11da76f149b524e35c460f6

                      SHA256

                      f1f29d017dbf3a573d5202ad354fb8b23a29d867130dea8a40907562f824a586

                      SHA512

                      d85f97b962699e747b648d6fc0f6f7ea9d476c2db30f827d654881de0a507da1c2cff4d773e4a9b3dec294293c61d5a211cf4327c46739c68a186a07ee8a2f2c

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qbya1zyp.o1s.ps1
                      Filesize

                      60B

                      MD5

                      d17fe0a3f47be24a6453e9ef58c94641

                      SHA1

                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                      SHA256

                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                      SHA512

                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                      Download Submit

                    • C:\Users\Admin\Contacts\Restore-My-Files.txt
                      Filesize

                      345B

                      MD5

                      7e0bb321581e4db9ae77e525e4ea8a5c

                      SHA1

                      0f9b00c0249e1d000a0116d941378f560241bc15

                      SHA256

                      3c863f21253b27ed2fa82b329d2d3b2d449536f3d7e6310580049f6ced4e91c5

                      SHA512

                      21b51f369f1c9d6f8af667287619c3a59f014ecfeb1a2c743196367876ed2f891bd1f49d31f804e0e921eb20f971abe372adb1491f00a21c7f60b43786d3b9ef

                      Download Submit

                    • C:\Users\Admin\Desktop\Cpriv.Loki
                      Filesize

                      3KB

                      MD5

                      7018f4740575f63dd83d97838cd17b37

                      SHA1

                      2728d72638f597db6362004cb529dae9b96bfcc0

                      SHA256

                      79c9530617535b023ee486b33dc1c57867c8e65a53765b46f575367af17712d4

                      SHA512

                      5c4d2303584080e70f5e44c4cd4ccbd1c14693e5c24f87d6b45083797df06f205fbca0f026a3851d8a08a57e29dd8ab3e645e9de3d3d514cd66cc0656759b7aa

                      Download Submit

                    • \??\c:\ProgramData\CSC2807E33C3EDF4A899AE39D86CF1DF944.TMP
                      Filesize

                      24KB

                      MD5

                      fec10e894405ed950c372c09d8f3a8d4

                      SHA1

                      132ee6af9eb6c9ff0cd76b8f272d742ccb481850

                      SHA256

                      50d36e555eaee2e128e53115c51561d61bbaebd36f1d9fed300406ea8621c019

                      SHA512

                      e9a2debd1b2a117e131537aa5f4daa0fa4dfea248c5e0d29ba84dd0c32f4ad34931feb929b333b014f264db00287c51e63ba769c4d38365421b90f431dec4719

                      Download Submit

                    • \??\c:\Users\Admin\AppData\Local\Temp\anvwnf4w\anvwnf4w.0.cs
                      Filesize

                      1KB

                      MD5

                      bd561560bf301a069d142abf570f17f1

                      SHA1

                      fe89f0a2d8ca36008714734726846f1655aa0ba9

                      SHA256

                      7d5508b2b4c1b0b98e6120c738993acbc4f36f23ee327ec81377c4afa6676b1a

                      SHA512

                      ddeb61ddb904a5f5d5e911d081aee20b3eee2ed69fd89c2fa32e1b1ec9de5ad70908e73527b5c2700d0a81bd05d56b1ac837a26cb58a98a21c658a06b11ad4a4

                      Download Submit

                    • \??\c:\Users\Admin\AppData\Local\Temp\anvwnf4w\anvwnf4w.cmdline
                      Filesize

                      236B

                      MD5

                      8b63fcbe50232c895419935257529976

                      SHA1

                      84d5879ce46d969de15bcb1a91b043facbcb12e1

                      SHA256

                      c93d9a93661abb41452eb95c1aab28cbb1a57c152ca3887f4615f61d5826626c

                      SHA512

                      049d2dd838a97b2ff99f0a1e93eb6290bccffe1a088d1a86d4e7b939cb723a21b1ece5cd620235a22b34d5d3b60cda349a8427177412e7cbe7f65b4b3e6c8fbf

                      Download Submit

                    • \??\c:\Users\Admin\AppData\Local\Temp\e3pskq22.ico
                      Filesize

                      23KB

                      MD5

                      8c9a5448905c6ad6f5a15ad8f102fa56

                      SHA1

                      185575a9708fe9ff122423e459eeed7098ad11d4

                      SHA256

                      fc65491d373c30593f9ef53d83959625dc384bc42d551aa77a666d4e9b538104

                      SHA512

                      2032d1f19ac0734339626531cd77ce0509dbba93260c87505d20998ab66aa3dceee4c94e10d8620cdcc62eacf9e63bbe5357afa2a09abdaa51ca0fde8b9aed50

                      Download Submit

                    • memory/1672-189-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-199-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-145-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-148-0x0000000004B60000-0x0000000004B70000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/1672-150-0x0000000004B60000-0x0000000004B70000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/1672-152-0x0000000004B60000-0x0000000004B70000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/1672-155-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-153-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-149-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-157-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-146-0x0000000004B60000-0x0000000004B70000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/1672-159-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-161-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-163-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-165-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-169-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-167-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-171-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-173-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-175-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-177-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-179-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-181-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-183-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-185-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-187-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-141-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-191-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-193-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-195-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-197-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-143-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-201-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-2193-0x0000000004B60000-0x0000000004B70000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/1672-2191-0x0000000004B60000-0x0000000004B70000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/1672-139-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-137-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-2195-0x0000000004B60000-0x0000000004B70000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/1672-2197-0x0000000004B60000-0x0000000004B70000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/1672-2630-0x00000000052D0000-0x0000000005336000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/1672-2640-0x0000000005F70000-0x0000000006002000-memory.dmp

                      Filesize

                      584KB

                      Download

                    • memory/1672-2657-0x0000000006370000-0x0000000006392000-memory.dmp

                      Filesize

                      136KB

                      Download

                    • memory/1672-133-0x0000000004D20000-0x00000000052C4000-memory.dmp

                      Filesize

                      5.6MB

                      Download

                    • memory/1672-134-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/1672-135-0x0000000004B70000-0x0000000004C3A000-memory.dmp

                      Filesize

                      808KB

                      Download

                    • memory/4204-2686-0x0000000006DE0000-0x0000000006DFE000-memory.dmp

                      Filesize

                      120KB

                      Download

                    • memory/4204-2687-0x000000007EF20000-0x000000007EF30000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/4204-2663-0x0000000006170000-0x00000000061D6000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/4204-2688-0x0000000008190000-0x000000000880A000-memory.dmp

                      Filesize

                      6.5MB

                      Download

                    • memory/4204-2673-0x0000000006850000-0x000000000686E000-memory.dmp

                      Filesize

                      120KB

                      Download

                    • memory/4204-2674-0x0000000005460000-0x0000000005470000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/4204-2675-0x0000000006E00000-0x0000000006E32000-memory.dmp

                      Filesize

                      200KB

                      Download

                    • memory/4204-2676-0x000000006FD60000-0x000000006FDAC000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/4204-2662-0x00000000060D0000-0x00000000060F2000-memory.dmp

                      Filesize

                      136KB

                      Download

                    • memory/4204-2661-0x0000000005460000-0x0000000005470000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/4204-2660-0x0000000005460000-0x0000000005470000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/4204-2689-0x0000000007B50000-0x0000000007B6A000-memory.dmp

                      Filesize

                      104KB

                      Download

                    • memory/4204-2690-0x0000000007BC0000-0x0000000007BCA000-memory.dmp

                      Filesize

                      40KB

                      Download

                    • memory/4204-2691-0x0000000007DD0000-0x0000000007E66000-memory.dmp

                      Filesize

                      600KB

                      Download

                    • memory/4204-2692-0x0000000007D80000-0x0000000007D8E000-memory.dmp

                      Filesize

                      56KB

                      Download

                    • memory/4204-2693-0x0000000007E90000-0x0000000007EAA000-memory.dmp

                      Filesize

                      104KB

                      Download

                    • memory/4204-2694-0x0000000007E70000-0x0000000007E78000-memory.dmp

                      Filesize

                      32KB

                      Download

                    • memory/4204-2659-0x0000000005AA0000-0x00000000060C8000-memory.dmp

                      Filesize

                      6.2MB

                      Download

                    • memory/4204-2658-0x0000000003270000-0x00000000032A6000-memory.dmp

                      Filesize

                      216KB

                      Download