Resubmissions
30-07-2023 06:59
230730-hsjknsgd78 1030-07-2023 06:57
230730-hrd9kagd75 1028-07-2023 15:26
230728-svbyqadh66 10Analysis
-
max time kernel
142s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
30-07-2023 06:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe
Resource
win7-20230712-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe
-
Size
320KB
-
MD5
cb7786ac2d9c0b586ccbe12b3bc32693
-
SHA1
4d40f8743c194671a96211ee6b4c751a4bf50871
-
SHA256
9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453
-
SHA512
cee77848b9bed772e32aca5009ebde34bf1ef1ad62197630a20d9c9de3905e09881a9dc639bd56bc44f499815ed92cbc93d254423793f7bec58a4ff2e42a593e
-
SSDEEP
6144:Vk1F9vhVI8vzPW2t1BOGu1CuDq1hzF0r2Z:VeF9jI8vzPnt7YCF0SZ
Score
10/10
Malware Config
Signatures
-
Clop
Ransomware discovered in early 2019 which has been actively developed since release.
-
Renames multiple (153) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s) 16 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe File opened for modification C:\Users\Admin\Links\desktop.ini 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe File opened for modification C:\Users\Admin\Music\desktop.ini 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeBackupPrivilege 1480 vssvc.exe Token: SeRestorePrivilege 1480 vssvc.exe Token: SeAuditPrivilege 1480 vssvc.exe Token: SeIncreaseQuotaPrivilege 1452 WMIC.exe Token: SeSecurityPrivilege 1452 WMIC.exe Token: SeTakeOwnershipPrivilege 1452 WMIC.exe Token: SeLoadDriverPrivilege 1452 WMIC.exe Token: SeSystemProfilePrivilege 1452 WMIC.exe Token: SeSystemtimePrivilege 1452 WMIC.exe Token: SeProfSingleProcessPrivilege 1452 WMIC.exe Token: SeIncBasePriorityPrivilege 1452 WMIC.exe Token: SeCreatePagefilePrivilege 1452 WMIC.exe Token: SeBackupPrivilege 1452 WMIC.exe Token: SeRestorePrivilege 1452 WMIC.exe Token: SeShutdownPrivilege 1452 WMIC.exe Token: SeDebugPrivilege 1452 WMIC.exe Token: SeSystemEnvironmentPrivilege 1452 WMIC.exe Token: SeRemoteShutdownPrivilege 1452 WMIC.exe Token: SeUndockPrivilege 1452 WMIC.exe Token: SeManageVolumePrivilege 1452 WMIC.exe Token: 33 1452 WMIC.exe Token: 34 1452 WMIC.exe Token: 35 1452 WMIC.exe Token: 36 1452 WMIC.exe Token: SeIncreaseQuotaPrivilege 1452 WMIC.exe Token: SeSecurityPrivilege 1452 WMIC.exe Token: SeTakeOwnershipPrivilege 1452 WMIC.exe Token: SeLoadDriverPrivilege 1452 WMIC.exe Token: SeSystemProfilePrivilege 1452 WMIC.exe Token: SeSystemtimePrivilege 1452 WMIC.exe Token: SeProfSingleProcessPrivilege 1452 WMIC.exe Token: SeIncBasePriorityPrivilege 1452 WMIC.exe Token: SeCreatePagefilePrivilege 1452 WMIC.exe Token: SeBackupPrivilege 1452 WMIC.exe Token: SeRestorePrivilege 1452 WMIC.exe Token: SeShutdownPrivilege 1452 WMIC.exe Token: SeDebugPrivilege 1452 WMIC.exe Token: SeSystemEnvironmentPrivilege 1452 WMIC.exe Token: SeRemoteShutdownPrivilege 1452 WMIC.exe Token: SeUndockPrivilege 1452 WMIC.exe Token: SeManageVolumePrivilege 1452 WMIC.exe Token: 33 1452 WMIC.exe Token: 34 1452 WMIC.exe Token: 35 1452 WMIC.exe Token: 36 1452 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4796 wrote to memory of 1904 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 89 PID 4796 wrote to memory of 1904 4796 9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe 89 PID 1904 wrote to memory of 1452 1904 cmd.exe 91 PID 1904 wrote to memory of 1452 1904 cmd.exe 91 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe"C:\Users\Admin\AppData\Local\Temp\9d0026a17b1bd281baf4cda8f6c7e52b9ed2edd180f8e3b85703931c50f11453.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{429C1165-60B1-4C42-9C37-B8D79D6133A8}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{429C1165-60B1-4C42-9C37-B8D79D6133A8}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1452
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1480
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1021B
MD5cc40a2ba1af80ab73e9496c5a1b5dc2e
SHA15a927aad3208578199780627917985c677fd0f07
SHA256a8363ff2d8ac192a8edd3aa9c8f7f3966ddefe1a3b65a9bc0566c2c79189fee4
SHA5125faaf001854fc9f2d865fa9b1dc46e7aacabb4b6104323dc1c9fe142141871a735fdc7780f36ca4736867aaca7212472a1ac6197cd60c1f72782a9de034f4b45