Overview
overview
10Static
static
10Alex-2023-...2).zip
windows7-x64
1Alex-2023-...2).zip
windows10-2004-x64
1037f9434e8...53.ps1
windows7-x64
1037f9434e8...53.ps1
windows10-2004-x64
105194b34f8...d4.exe
windows7-x64
105194b34f8...d4.exe
windows10-2004-x64
11285e648ef...9709ff
ubuntu-18.04-amd64
3159fbb0d04...783614
windows7-x64
1159fbb0d04...783614
windows10-2004-x64
11db1c4bf74...e85efd
ubuntu-18.04-amd64
11db1c4bf74...e85efd
debian-9-armhf
11db1c4bf74...e85efd
debian-9-mips
11db1c4bf74...e85efd
debian-9-mipsel
129dd920ac1...e5.zip
windows7-x64
129dd920ac1...e5.zip
windows10-2004-x64
12001.exe
windows7-x64
92001.exe
windows10-2004-x64
92bb60b1a8a...21.exe
windows7-x64
102bb60b1a8a...21.exe
windows10-2004-x64
106698f8ffb7...880c94
windows7-x64
16698f8ffb7...880c94
windows10-2004-x64
16c109d098a...8e.exe
windows7-x64
106c109d098a...8e.exe
windows10-2004-x64
1070d176272e...ef.exe
windows7-x64
170d176272e...ef.exe
windows10-2004-x64
1742d89c0c1...a1.exe
windows7-x64
9742d89c0c1...a1.exe
windows10-2004-x64
975cd1339c8...bc.zip
windows7-x64
175cd1339c8...bc.zip
windows10-2004-x64
1Dimples#1337.jar
windows7-x64
1Dimples#1337.jar
windows10-2004-x64
7832e563eb3...0cee4c
windows7-x64
1Analysis
-
max time kernel
131s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01-01-2024 13:38
Behavioral task
behavioral1
Sample
Alex-2023-08-01-52-ransomware-samples (2).zip
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral2
Sample
Alex-2023-08-01-52-ransomware-samples (2).zip
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
037f9434e83919506544aa04fecd7f56446a7cc65ee03ac0a11570cf4f607853.ps1
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral4
Sample
037f9434e83919506544aa04fecd7f56446a7cc65ee03ac0a11570cf4f607853.ps1
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
05194b34f8ff89facdd7b56d05826b08edaec9c6e444bdc32913e02cab01afd4.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral6
Sample
05194b34f8ff89facdd7b56d05826b08edaec9c6e444bdc32913e02cab01afd4.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
1285e648efbbeb50a2dddcd622a2230690975eb68cb05fdf0873ed3d359709ff
Resource
ubuntu1804-amd64-20231222-en
ubuntu-18.04-amd64
Behavioral task
behavioral8
Sample
159fbb0d04c1a77d434ce3810d1e2c659fda0a5703c9d06f89ee8dc556783614
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral9
Sample
159fbb0d04c1a77d434ce3810d1e2c659fda0a5703c9d06f89ee8dc556783614
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
1db1c4bf74d0aca8e06a007701899c93be174a9391a74f5258f03149a0e85efd
Resource
ubuntu1804-amd64-20231215-en
ubuntu-18.04-amd64
Behavioral task
behavioral11
Sample
1db1c4bf74d0aca8e06a007701899c93be174a9391a74f5258f03149a0e85efd
Resource
debian9-armhf-20231222-en
debian-9-armhf
Behavioral task
behavioral12
Sample
1db1c4bf74d0aca8e06a007701899c93be174a9391a74f5258f03149a0e85efd
Resource
debian9-mipsbe-20231215-en
debian-9-mips
Behavioral task
behavioral13
Sample
1db1c4bf74d0aca8e06a007701899c93be174a9391a74f5258f03149a0e85efd
Resource
debian9-mipsel-20231215-en
debian-9-mipsel
Behavioral task
behavioral14
Sample
29dd920ac1453b5be12fcef5af45690dbbe625e985f6692e237a057e832937e5.zip
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral15
Sample
29dd920ac1453b5be12fcef5af45690dbbe625e985f6692e237a057e832937e5.zip
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
2001.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral17
Sample
2001.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
2bb60b1a8a0a1ee7c5eb44306f6007891ff95c39b851f74ec609481e0dd08321.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral19
Sample
2bb60b1a8a0a1ee7c5eb44306f6007891ff95c39b851f74ec609481e0dd08321.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
6698f8ffb7ba04c2496634ff69b0a3de9537716cfc8f76d1cfea419dbd880c94
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral21
Sample
6698f8ffb7ba04c2496634ff69b0a3de9537716cfc8f76d1cfea419dbd880c94
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
6c109d098a1f44017f3937a71628d9dbd4d2ca8aa266656ee4720c37cc31558e.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral23
Sample
6c109d098a1f44017f3937a71628d9dbd4d2ca8aa266656ee4720c37cc31558e.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
70d176272ef4e088bbaf2f1db5658131e2b99bdb5c2a2f89bb522c900d8a2def.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral25
Sample
70d176272ef4e088bbaf2f1db5658131e2b99bdb5c2a2f89bb522c900d8a2def.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
742d89c0c1e345a4b2197f3e25b293d7126acfaf954c99243047a6c07003f5a1.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral27
Sample
742d89c0c1e345a4b2197f3e25b293d7126acfaf954c99243047a6c07003f5a1.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
75cd1339c8bd95dd4340bb8be524ec098fd18a80c242e0e0f8da3bbbccd641bc.zip
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral29
Sample
75cd1339c8bd95dd4340bb8be524ec098fd18a80c242e0e0f8da3bbbccd641bc.zip
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
Dimples#1337.jar
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral31
Sample
Dimples#1337.jar
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
832e563eb312cfaa4dba012f2350e188be5ed6f62eab38b209f4abe7dc0cee4c
Resource
win7-20231215-en
windows7-x64
General
-
Target
2001.exe
-
Size
138KB
-
MD5
b9272a777740d1b5796cc6eaf7eff252
-
SHA1
43526f39d742bb421ebe2514fa1e7bee2ec0f86d
-
SHA256
df93154c63aeea6a56d0f2b4c89d424f38897c2a43d756495efa4cfa69f87aa4
-
SHA512
2e19dd25e46400878b6fcecceb8a7f650a996e47f8b785f3a63e640710951a4a8fe6991842879d1959b65f59f25ccefc76b39bd9d46fa62e3acb5d5a481544bc
-
SSDEEP
3072:1ZO75plD368W/5SeiLHpV3IhzfW+3g70XdlqgDuYUB/vemeeCLdJLVd:1C5px3HW/3iLHpV4hzu+jd7uYU5JexTd
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (248) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: 2001.exe File opened (read-only) \??\U: 2001.exe File opened (read-only) \??\V: 2001.exe File opened (read-only) \??\P: 2001.exe File opened (read-only) \??\L: 2001.exe File opened (read-only) \??\N: 2001.exe File opened (read-only) \??\O: 2001.exe File opened (read-only) \??\R: 2001.exe File opened (read-only) \??\X: 2001.exe File opened (read-only) \??\I: 2001.exe File opened (read-only) \??\B: 2001.exe File opened (read-only) \??\G: 2001.exe File opened (read-only) \??\H: 2001.exe File opened (read-only) \??\J: 2001.exe File opened (read-only) \??\K: 2001.exe File opened (read-only) \??\M: 2001.exe File opened (read-only) \??\T: 2001.exe File opened (read-only) \??\A: 2001.exe File opened (read-only) \??\W: 2001.exe File opened (read-only) \??\E: 2001.exe File opened (read-only) \??\S: 2001.exe File opened (read-only) \??\Y: 2001.exe File opened (read-only) \??\Z: 2001.exe File opened (read-only) \??\F: 2001.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 5 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2560 vssadmin.exe 2568 vssadmin.exe 2688 vssadmin.exe 2760 vssadmin.exe 2592 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe 2168 2001.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2728 wmic.exe Token: SeSecurityPrivilege 2728 wmic.exe Token: SeTakeOwnershipPrivilege 2728 wmic.exe Token: SeLoadDriverPrivilege 2728 wmic.exe Token: SeSystemProfilePrivilege 2728 wmic.exe Token: SeSystemtimePrivilege 2728 wmic.exe Token: SeProfSingleProcessPrivilege 2728 wmic.exe Token: SeIncBasePriorityPrivilege 2728 wmic.exe Token: SeCreatePagefilePrivilege 2728 wmic.exe Token: SeBackupPrivilege 2728 wmic.exe Token: SeRestorePrivilege 2728 wmic.exe Token: SeShutdownPrivilege 2728 wmic.exe Token: SeDebugPrivilege 2728 wmic.exe Token: SeSystemEnvironmentPrivilege 2728 wmic.exe Token: SeRemoteShutdownPrivilege 2728 wmic.exe Token: SeUndockPrivilege 2728 wmic.exe Token: SeManageVolumePrivilege 2728 wmic.exe Token: 33 2728 wmic.exe Token: 34 2728 wmic.exe Token: 35 2728 wmic.exe Token: SeBackupPrivilege 2772 vssvc.exe Token: SeRestorePrivilege 2772 vssvc.exe Token: SeAuditPrivilege 2772 vssvc.exe Token: SeIncreaseQuotaPrivilege 2208 wmic.exe Token: SeSecurityPrivilege 2208 wmic.exe Token: SeTakeOwnershipPrivilege 2208 wmic.exe Token: SeLoadDriverPrivilege 2208 wmic.exe Token: SeSystemProfilePrivilege 2208 wmic.exe Token: SeSystemtimePrivilege 2208 wmic.exe Token: SeProfSingleProcessPrivilege 2208 wmic.exe Token: SeIncBasePriorityPrivilege 2208 wmic.exe Token: SeCreatePagefilePrivilege 2208 wmic.exe Token: SeBackupPrivilege 2208 wmic.exe Token: SeRestorePrivilege 2208 wmic.exe Token: SeShutdownPrivilege 2208 wmic.exe Token: SeDebugPrivilege 2208 wmic.exe Token: SeSystemEnvironmentPrivilege 2208 wmic.exe Token: SeRemoteShutdownPrivilege 2208 wmic.exe Token: SeUndockPrivilege 2208 wmic.exe Token: SeManageVolumePrivilege 2208 wmic.exe Token: 33 2208 wmic.exe Token: 34 2208 wmic.exe Token: 35 2208 wmic.exe Token: SeIncreaseQuotaPrivilege 2708 wmic.exe Token: SeSecurityPrivilege 2708 wmic.exe Token: SeTakeOwnershipPrivilege 2708 wmic.exe Token: SeLoadDriverPrivilege 2708 wmic.exe Token: SeSystemProfilePrivilege 2708 wmic.exe Token: SeSystemtimePrivilege 2708 wmic.exe Token: SeProfSingleProcessPrivilege 2708 wmic.exe Token: SeIncBasePriorityPrivilege 2708 wmic.exe Token: SeCreatePagefilePrivilege 2708 wmic.exe Token: SeBackupPrivilege 2708 wmic.exe Token: SeRestorePrivilege 2708 wmic.exe Token: SeShutdownPrivilege 2708 wmic.exe Token: SeDebugPrivilege 2708 wmic.exe Token: SeSystemEnvironmentPrivilege 2708 wmic.exe Token: SeRemoteShutdownPrivilege 2708 wmic.exe Token: SeUndockPrivilege 2708 wmic.exe Token: SeManageVolumePrivilege 2708 wmic.exe Token: 33 2708 wmic.exe Token: 34 2708 wmic.exe Token: 35 2708 wmic.exe Token: SeIncreaseQuotaPrivilege 3024 wmic.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2168 wrote to memory of 2728 2168 2001.exe 37 PID 2168 wrote to memory of 2728 2168 2001.exe 37 PID 2168 wrote to memory of 2728 2168 2001.exe 37 PID 2168 wrote to memory of 2728 2168 2001.exe 37 PID 2168 wrote to memory of 2688 2168 2001.exe 36 PID 2168 wrote to memory of 2688 2168 2001.exe 36 PID 2168 wrote to memory of 2688 2168 2001.exe 36 PID 2168 wrote to memory of 2688 2168 2001.exe 36 PID 2168 wrote to memory of 2208 2168 2001.exe 34 PID 2168 wrote to memory of 2208 2168 2001.exe 34 PID 2168 wrote to memory of 2208 2168 2001.exe 34 PID 2168 wrote to memory of 2208 2168 2001.exe 34 PID 2168 wrote to memory of 2568 2168 2001.exe 33 PID 2168 wrote to memory of 2568 2168 2001.exe 33 PID 2168 wrote to memory of 2568 2168 2001.exe 33 PID 2168 wrote to memory of 2568 2168 2001.exe 33 PID 2168 wrote to memory of 2708 2168 2001.exe 31 PID 2168 wrote to memory of 2708 2168 2001.exe 31 PID 2168 wrote to memory of 2708 2168 2001.exe 31 PID 2168 wrote to memory of 2708 2168 2001.exe 31 PID 2168 wrote to memory of 2560 2168 2001.exe 30 PID 2168 wrote to memory of 2560 2168 2001.exe 30 PID 2168 wrote to memory of 2560 2168 2001.exe 30 PID 2168 wrote to memory of 2560 2168 2001.exe 30 PID 2168 wrote to memory of 3024 2168 2001.exe 28 PID 2168 wrote to memory of 3024 2168 2001.exe 28 PID 2168 wrote to memory of 3024 2168 2001.exe 28 PID 2168 wrote to memory of 3024 2168 2001.exe 28 PID 2168 wrote to memory of 2592 2168 2001.exe 26 PID 2168 wrote to memory of 2592 2168 2001.exe 26 PID 2168 wrote to memory of 2592 2168 2001.exe 26 PID 2168 wrote to memory of 2592 2168 2001.exe 26 PID 2168 wrote to memory of 2604 2168 2001.exe 24 PID 2168 wrote to memory of 2604 2168 2001.exe 24 PID 2168 wrote to memory of 2604 2168 2001.exe 24 PID 2168 wrote to memory of 2604 2168 2001.exe 24 PID 2168 wrote to memory of 2760 2168 2001.exe 22 PID 2168 wrote to memory of 2760 2168 2001.exe 22 PID 2168 wrote to memory of 2760 2168 2001.exe 22 PID 2168 wrote to memory of 2760 2168 2001.exe 22 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2001.exe"C:\Users\Admin\AppData\Local\Temp\2001.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:2760
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵PID:2604
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:2592
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3024
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:2560
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2708
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:2568
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2208
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:2688
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2728
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2772
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
472B
MD5774c818da867b4e5c398d9e91f7d0e13
SHA102e630fe998b509df40acb50b52654c35e3a8820
SHA25648a4aecf214e7745eaea70da94f24b592b1cdf085f9ee27c05f0cecf2bb189e9
SHA5124ddc5ec9a3b7d89b5475949ed2e4444fb9e40551f903f29eca7553e565a21a9c8a54f899361d8ce85a7b406bb38f408733cf518bf77058803a2b806c26f4d593