Overview
overview
10Static
static
10samples (2) (3).zip
windows7-x64
1samples (2) (3).zip
windows10-2004-x64
1100b8bfff5...48.exe
windows7-x64
1100b8bfff5...48.exe
windows10-2004-x64
116b5122423...49.exe
windows7-x64
716b5122423...49.exe
windows10-2004-x64
72727dde741...98.exe
windows7-x64
92727dde741...98.exe
windows10-2004-x64
929dd920ac1...e5.zip
windows7-x64
129dd920ac1...e5.zip
windows10-2004-x64
12001.exe
windows7-x64
92001.exe
windows10-2004-x64
93c5ffe21fd...017.js
windows7-x64
13c5ffe21fd...017.js
windows10-2004-x64
148493bb68b...20.exe
windows7-x64
1048493bb68b...20.exe
windows10-2004-x64
10568a79ce58...19.exe
windows7-x64
9568a79ce58...19.exe
windows10-2004-x64
957de0d2d59...fe.exe
windows7-x64
957de0d2d59...fe.exe
windows10-2004-x64
75e34ceeaf6...05.exe
windows7-x64
15e34ceeaf6...05.exe
windows10-2004-x64
16e2db44578...ac.exe
windows7-x64
96e2db44578...ac.exe
windows10-2004-x64
975342ada93...76.exe
windows7-x64
875342ada93...76.exe
windows10-2004-x64
67e623dca8a...e2.exe
windows7-x64
107e623dca8a...e2.exe
windows10-2004-x64
1087f2db714e...7e.exe
windows7-x64
887f2db714e...7e.exe
windows10-2004-x64
88dcb1af1e7...b0.exe
windows7-x64
78dcb1af1e7...b0.exe
windows10-2004-x64
7Analysis
-
max time kernel
135s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01-01-2024 15:12
Behavioral task
behavioral1
Sample
samples (2) (3).zip
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral2
Sample
samples (2) (3).zip
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
100b8bfff550fb74c98a2ef9a71d4bb53553d2d7ba509bb451fe32814ec57e48.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral4
Sample
100b8bfff550fb74c98a2ef9a71d4bb53553d2d7ba509bb451fe32814ec57e48.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
16b51224239d3671b1af3e8f2656a2ad1e7f5fb9acb09111a95461338a841b49.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral6
Sample
16b51224239d3671b1af3e8f2656a2ad1e7f5fb9acb09111a95461338a841b49.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
2727dde7418284bd2b16a032346a9c6921cbfb5e950ad21c9468792b71ee3898.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral8
Sample
2727dde7418284bd2b16a032346a9c6921cbfb5e950ad21c9468792b71ee3898.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
29dd920ac1453b5be12fcef5af45690dbbe625e985f6692e237a057e832937e5.zip
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral10
Sample
29dd920ac1453b5be12fcef5af45690dbbe625e985f6692e237a057e832937e5.zip
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
2001.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral12
Sample
2001.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
3c5ffe21fd24c4daf62f5190d96e65bf7a25232ef9ec956a77db910e90750017.js
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral14
Sample
3c5ffe21fd24c4daf62f5190d96e65bf7a25232ef9ec956a77db910e90750017.js
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
48493bb68bc1062b11cc505e444db288ec6cba0c979d10a9b5a3ea775daf9420.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral16
Sample
48493bb68bc1062b11cc505e444db288ec6cba0c979d10a9b5a3ea775daf9420.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral18
Sample
568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
57de0d2d5945db11d6c845459419a1b48a5cf415a7a0866c40b03afaec6fb4fe.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral20
Sample
57de0d2d5945db11d6c845459419a1b48a5cf415a7a0866c40b03afaec6fb4fe.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
5e34ceeaf60a7cdfaeee0443a87edb92115727130323314628503dfe755b9505.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral22
Sample
5e34ceeaf60a7cdfaeee0443a87edb92115727130323314628503dfe755b9505.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral24
Sample
6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral26
Sample
75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral28
Sample
7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral30
Sample
87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
8dcb1af1e7886834252394e9710ee72b9bfa910779c4ea041831d0622efa85b0.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral32
Sample
8dcb1af1e7886834252394e9710ee72b9bfa910779c4ea041831d0622efa85b0.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
General
-
Target
2001.exe
-
Size
138KB
-
MD5
b9272a777740d1b5796cc6eaf7eff252
-
SHA1
43526f39d742bb421ebe2514fa1e7bee2ec0f86d
-
SHA256
df93154c63aeea6a56d0f2b4c89d424f38897c2a43d756495efa4cfa69f87aa4
-
SHA512
2e19dd25e46400878b6fcecceb8a7f650a996e47f8b785f3a63e640710951a4a8fe6991842879d1959b65f59f25ccefc76b39bd9d46fa62e3acb5d5a481544bc
-
SSDEEP
3072:1ZO75plD368W/5SeiLHpV3IhzfW+3g70XdlqgDuYUB/vemeeCLdJLVd:1C5px3HW/3iLHpV4hzu+jd7uYU5JexTd
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (266) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: 2001.exe File opened (read-only) \??\V: 2001.exe File opened (read-only) \??\Z: 2001.exe File opened (read-only) \??\N: 2001.exe File opened (read-only) \??\E: 2001.exe File opened (read-only) \??\H: 2001.exe File opened (read-only) \??\K: 2001.exe File opened (read-only) \??\M: 2001.exe File opened (read-only) \??\X: 2001.exe File opened (read-only) \??\Y: 2001.exe File opened (read-only) \??\A: 2001.exe File opened (read-only) \??\J: 2001.exe File opened (read-only) \??\P: 2001.exe File opened (read-only) \??\Q: 2001.exe File opened (read-only) \??\U: 2001.exe File opened (read-only) \??\G: 2001.exe File opened (read-only) \??\B: 2001.exe File opened (read-only) \??\I: 2001.exe File opened (read-only) \??\L: 2001.exe File opened (read-only) \??\O: 2001.exe File opened (read-only) \??\R: 2001.exe File opened (read-only) \??\S: 2001.exe File opened (read-only) \??\W: 2001.exe File opened (read-only) \??\F: 2001.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 5 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2816 vssadmin.exe 752 vssadmin.exe 2316 vssadmin.exe 1772 vssadmin.exe 568 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe 2184 2001.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2188 wmic.exe Token: SeSecurityPrivilege 2188 wmic.exe Token: SeTakeOwnershipPrivilege 2188 wmic.exe Token: SeLoadDriverPrivilege 2188 wmic.exe Token: SeSystemProfilePrivilege 2188 wmic.exe Token: SeSystemtimePrivilege 2188 wmic.exe Token: SeProfSingleProcessPrivilege 2188 wmic.exe Token: SeIncBasePriorityPrivilege 2188 wmic.exe Token: SeCreatePagefilePrivilege 2188 wmic.exe Token: SeBackupPrivilege 2188 wmic.exe Token: SeRestorePrivilege 2188 wmic.exe Token: SeShutdownPrivilege 2188 wmic.exe Token: SeDebugPrivilege 2188 wmic.exe Token: SeSystemEnvironmentPrivilege 2188 wmic.exe Token: SeRemoteShutdownPrivilege 2188 wmic.exe Token: SeUndockPrivilege 2188 wmic.exe Token: SeManageVolumePrivilege 2188 wmic.exe Token: 33 2188 wmic.exe Token: 34 2188 wmic.exe Token: 35 2188 wmic.exe Token: SeBackupPrivilege 2708 vssvc.exe Token: SeRestorePrivilege 2708 vssvc.exe Token: SeAuditPrivilege 2708 vssvc.exe Token: SeIncreaseQuotaPrivilege 2764 wmic.exe Token: SeSecurityPrivilege 2764 wmic.exe Token: SeTakeOwnershipPrivilege 2764 wmic.exe Token: SeLoadDriverPrivilege 2764 wmic.exe Token: SeSystemProfilePrivilege 2764 wmic.exe Token: SeSystemtimePrivilege 2764 wmic.exe Token: SeProfSingleProcessPrivilege 2764 wmic.exe Token: SeIncBasePriorityPrivilege 2764 wmic.exe Token: SeCreatePagefilePrivilege 2764 wmic.exe Token: SeBackupPrivilege 2764 wmic.exe Token: SeRestorePrivilege 2764 wmic.exe Token: SeShutdownPrivilege 2764 wmic.exe Token: SeDebugPrivilege 2764 wmic.exe Token: SeSystemEnvironmentPrivilege 2764 wmic.exe Token: SeRemoteShutdownPrivilege 2764 wmic.exe Token: SeUndockPrivilege 2764 wmic.exe Token: SeManageVolumePrivilege 2764 wmic.exe Token: 33 2764 wmic.exe Token: 34 2764 wmic.exe Token: 35 2764 wmic.exe Token: SeIncreaseQuotaPrivilege 2636 wmic.exe Token: SeSecurityPrivilege 2636 wmic.exe Token: SeTakeOwnershipPrivilege 2636 wmic.exe Token: SeLoadDriverPrivilege 2636 wmic.exe Token: SeSystemProfilePrivilege 2636 wmic.exe Token: SeSystemtimePrivilege 2636 wmic.exe Token: SeProfSingleProcessPrivilege 2636 wmic.exe Token: SeIncBasePriorityPrivilege 2636 wmic.exe Token: SeCreatePagefilePrivilege 2636 wmic.exe Token: SeBackupPrivilege 2636 wmic.exe Token: SeRestorePrivilege 2636 wmic.exe Token: SeShutdownPrivilege 2636 wmic.exe Token: SeDebugPrivilege 2636 wmic.exe Token: SeSystemEnvironmentPrivilege 2636 wmic.exe Token: SeRemoteShutdownPrivilege 2636 wmic.exe Token: SeUndockPrivilege 2636 wmic.exe Token: SeManageVolumePrivilege 2636 wmic.exe Token: 33 2636 wmic.exe Token: 34 2636 wmic.exe Token: 35 2636 wmic.exe Token: SeIncreaseQuotaPrivilege 588 wmic.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2188 2184 2001.exe 28 PID 2184 wrote to memory of 2188 2184 2001.exe 28 PID 2184 wrote to memory of 2188 2184 2001.exe 28 PID 2184 wrote to memory of 2188 2184 2001.exe 28 PID 2184 wrote to memory of 2816 2184 2001.exe 30 PID 2184 wrote to memory of 2816 2184 2001.exe 30 PID 2184 wrote to memory of 2816 2184 2001.exe 30 PID 2184 wrote to memory of 2816 2184 2001.exe 30 PID 2184 wrote to memory of 2764 2184 2001.exe 33 PID 2184 wrote to memory of 2764 2184 2001.exe 33 PID 2184 wrote to memory of 2764 2184 2001.exe 33 PID 2184 wrote to memory of 2764 2184 2001.exe 33 PID 2184 wrote to memory of 752 2184 2001.exe 35 PID 2184 wrote to memory of 752 2184 2001.exe 35 PID 2184 wrote to memory of 752 2184 2001.exe 35 PID 2184 wrote to memory of 752 2184 2001.exe 35 PID 2184 wrote to memory of 2636 2184 2001.exe 37 PID 2184 wrote to memory of 2636 2184 2001.exe 37 PID 2184 wrote to memory of 2636 2184 2001.exe 37 PID 2184 wrote to memory of 2636 2184 2001.exe 37 PID 2184 wrote to memory of 2316 2184 2001.exe 39 PID 2184 wrote to memory of 2316 2184 2001.exe 39 PID 2184 wrote to memory of 2316 2184 2001.exe 39 PID 2184 wrote to memory of 2316 2184 2001.exe 39 PID 2184 wrote to memory of 588 2184 2001.exe 41 PID 2184 wrote to memory of 588 2184 2001.exe 41 PID 2184 wrote to memory of 588 2184 2001.exe 41 PID 2184 wrote to memory of 588 2184 2001.exe 41 PID 2184 wrote to memory of 1772 2184 2001.exe 43 PID 2184 wrote to memory of 1772 2184 2001.exe 43 PID 2184 wrote to memory of 1772 2184 2001.exe 43 PID 2184 wrote to memory of 1772 2184 2001.exe 43 PID 2184 wrote to memory of 584 2184 2001.exe 45 PID 2184 wrote to memory of 584 2184 2001.exe 45 PID 2184 wrote to memory of 584 2184 2001.exe 45 PID 2184 wrote to memory of 584 2184 2001.exe 45 PID 2184 wrote to memory of 568 2184 2001.exe 47 PID 2184 wrote to memory of 568 2184 2001.exe 47 PID 2184 wrote to memory of 568 2184 2001.exe 47 PID 2184 wrote to memory of 568 2184 2001.exe 47 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2001.exe"C:\Users\Admin\AppData\Local\Temp\2001.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2188
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:2816
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2764
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:752
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2636
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:2316
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:588
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1772
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵PID:584
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:568
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
472B
MD5774c818da867b4e5c398d9e91f7d0e13
SHA102e630fe998b509df40acb50b52654c35e3a8820
SHA25648a4aecf214e7745eaea70da94f24b592b1cdf085f9ee27c05f0cecf2bb189e9
SHA5124ddc5ec9a3b7d89b5475949ed2e4444fb9e40551f903f29eca7553e565a21a9c8a54f899361d8ce85a7b406bb38f408733cf518bf77058803a2b806c26f4d593