4b20937d2f09872bdb78359d0df30b554d514c7f2df07c4026f99c859b09d1f1

General

Target

9b1da810487cdcb458d46f394f561fdb.exe
Size

766KB
MD5

9b1da810487cdcb458d46f394f561fdb
SHA1

b8fbf9babf7182cf7dd1e6039e4c2a072a4df70c
SHA256

4b20937d2f09872bdb78359d0df30b554d514c7f2df07c4026f99c859b09d1f1
SHA512

babbecf43d00e1cfe58b9b3d2895993624e62f136178f64616f43e49c1006dc9d64d6e2dcfa3b88434ad9b9790270aa063236deaaf92022d8b3ebeaa42efd7fc
SSDEEP

12288:CH+pDu9YrDQKiXEfiVzhY1Iys0P9ckgveteiZLnfHSoGKmeVd8kyBwvBH4JVJ:Ce0sDNiUfiPgI91kgveYAHSoGoWeOVJ

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\edatocus = "\"C:\\Windows\\bjyxefyc.exe\""	explorer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	9b1da810487cdcb458d46f394f561fdb.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2532 set thread context of 3900	2532	9b1da810487cdcb458d46f394f561fdb.exe	95
PID 3900 set thread context of 4536	3900	9b1da810487cdcb458d46f394f561fdb.exe	96

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\bjyxefyc.exe	explorer.exe
File opened for modification	C:\Windows\bjyxefyc.exe	explorer.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
3372	vssadmin.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\PhishingFilter	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	explorer.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	4288	vssvc.exe
Token: SeRestorePrivilege	4288	vssvc.exe
Token: SeAuditPrivilege	4288	vssvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 3900	2532	9b1da810487cdcb458d46f394f561fdb.exe	95
PID 2532 wrote to memory of 3900	2532	9b1da810487cdcb458d46f394f561fdb.exe	95
PID 2532 wrote to memory of 3900	2532	9b1da810487cdcb458d46f394f561fdb.exe	95
PID 2532 wrote to memory of 3900	2532	9b1da810487cdcb458d46f394f561fdb.exe	95
PID 2532 wrote to memory of 3900	2532	9b1da810487cdcb458d46f394f561fdb.exe	95
PID 3900 wrote to memory of 4536	3900	9b1da810487cdcb458d46f394f561fdb.exe	96
PID 3900 wrote to memory of 4536	3900	9b1da810487cdcb458d46f394f561fdb.exe	96
PID 3900 wrote to memory of 4536	3900	9b1da810487cdcb458d46f394f561fdb.exe	96
PID 3900 wrote to memory of 4536	3900	9b1da810487cdcb458d46f394f561fdb.exe	96
PID 4536 wrote to memory of 3372	4536	explorer.exe	98
PID 4536 wrote to memory of 3372	4536	explorer.exe	98

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\9b1da810487cdcb458d46f394f561fdb.exe
"C:\Users\Admin\AppData\Local\Temp\9b1da810487cdcb458d46f394f561fdb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Users\Admin\AppData\Local\Temp\9b1da810487cdcb458d46f394f561fdb.exe
  "C:\Users\Admin\AppData\Local\Temp\9b1da810487cdcb458d46f394f561fdb.exe"
  2⤵
  - Checks whether UAC is enabled
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\system32\explorer.exe"
    3⤵
    - Adds Run key to start application
    - Drops file in Windows directory
    - Modifies Internet Explorer Phishing Filter
    - Suspicious use of WriteProcessMemory
    PID:4536
  - - C:\Windows\SYSTEM32\vssadmin.exe
      vssadmin.exe Delete Shadows /All /Quiet
      4⤵
      Interacts with shadow copies
      PID:3372

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

2

T1070

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\aduqeliginopicah\01000000

Filesize
766KB

MD5
b08099f62223f6fcb24b05adcbbc74ad

SHA1
af92c74915e34d1d63d03783132d424848843de5

SHA256
659aa6c68411cdbcfd6053ec3db63a4b3b2ceedeba3b21488b8690e3259d8e38

SHA512
5dd58501fc459b0bd3d742a022cf5a10cfb8d3d699f8e1d7394ee3e217e8be25f9253cea61ad4978a76b0471c3e0f338a9ec06f19bdc402eefc84cd0b5a40e27

Download Submit
memory/2532-0-0x0000000002270000-0x0000000002271000-memory.dmp

Filesize
4KB

Download
memory/2532-1-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/2532-3-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/3900-6-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3900-5-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3900-4-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3900-14-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3900-2-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4536-8-0x00000000004D0000-0x000000000050C000-memory.dmp

Filesize
240KB

Download
memory/4536-19-0x00000000004D0000-0x000000000050C000-memory.dmp

Filesize
240KB

Download
memory/4536-20-0x00000000004D0000-0x000000000050C000-memory.dmp

Filesize
240KB

Download
memory/4536-17-0x00000000004D0000-0x000000000050C000-memory.dmp

Filesize
240KB

Download
memory/4536-10-0x00000000004D0000-0x000000000050C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads