Analysis
- max time kernel
119s - max time network
120s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system - submitted
10/01/2024, 01:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe
Resource
win7-20231129-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe
- Size 216KB
- Sample240110-bhfmpscbd7
- SHA256 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc
- MD5 18baedf43f4a68455e8d36b657aff03c
- SHA1 5770b7c3931f6ed12650ad27b7fb2bf0752b80dc
- SHA512 3c3161e2b209b7589be33be288076af6b0e81c000ab66f7eb184ce54114b7e4687cc33e95bc9daf8b61394d8f847f85858bf0c978dbf829c0cd1fd9620231d4e
- SSDEEP 3072:h17DaAz38w3vQ7F6PFwgBZTGFKQ+avVe+gGooSlFC2OLKKZAFEMpo4Iv1k:Fb8JF6Pf2KQ+aVB2fJqh4Id
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Renames multiple (280) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\M:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe File opened (read-only) \??\A: 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe File opened (read-only) \??\Z: 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe File opened (read-only) \??\X: 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe File opened (read-only) \??\O: 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe File opened (read-only) \??\S: 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe File opened (read-only) \??\H: 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe File opened (read-only) \??\N: 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe File opened (read-only) \??\J: 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe File opened (read-only) \??\K: 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe File opened (read-only) \??\B: 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe File opened (read-only) \??\M: 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe File opened (read-only) \??\Q: 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe File opened (read-only) \??\R: 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe File opened (read-only) \??\I: 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe File opened (read-only) \??\G: 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe File opened (read-only) \??\P: 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe File opened (read-only) \??\L: 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe File opened (read-only) \??\V: 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe File opened (read-only) \??\W: 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe File opened (read-only) \??\E: 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe File opened (read-only) \??\T: 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe File opened (read-only) \??\U: 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe - Modifies boot configuration data using bcdedit 4 IoCs
pid Process 2016 bcdedit.exe 1860 bcdedit.exe 1624 bcdedit.exe 1724 bcdedit.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\readme.bmp" 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1740 vssadmin.exe 1844 vssadmin.exe - Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\WallpaperStyle = "0" 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\TileWallpaper = "0" 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2972 WMIC.exe Token: SeSecurityPrivilege 2972 WMIC.exe Token: SeTakeOwnershipPrivilege 2972 WMIC.exe Token: SeLoadDriverPrivilege 2972 WMIC.exe Token: SeSystemProfilePrivilege 2972 WMIC.exe Token: SeSystemtimePrivilege 2972 WMIC.exe Token: SeProfSingleProcessPrivilege 2972 WMIC.exe Token: SeIncBasePriorityPrivilege 2972 WMIC.exe Token: SeCreatePagefilePrivilege 2972 WMIC.exe Token: SeBackupPrivilege 2972 WMIC.exe Token: SeRestorePrivilege 2972 WMIC.exe Token: SeShutdownPrivilege 2972 WMIC.exe Token: SeDebugPrivilege 2972 WMIC.exe Token: SeSystemEnvironmentPrivilege 2972 WMIC.exe Token: SeRemoteShutdownPrivilege 2972 WMIC.exe Token: SeUndockPrivilege 2972 WMIC.exe Token: SeManageVolumePrivilege 2972 WMIC.exe Token: 33 2972 WMIC.exe Token: 34 2972 WMIC.exe Token: 35 2972 WMIC.exe Token: SeIncreaseQuotaPrivilege 2972 WMIC.exe Token: SeSecurityPrivilege 2972 WMIC.exe Token: SeTakeOwnershipPrivilege 2972 WMIC.exe Token: SeLoadDriverPrivilege 2972 WMIC.exe Token: SeSystemProfilePrivilege 2972 WMIC.exe Token: SeSystemtimePrivilege 2972 WMIC.exe Token: SeProfSingleProcessPrivilege 2972 WMIC.exe Token: SeIncBasePriorityPrivilege 2972 WMIC.exe Token: SeCreatePagefilePrivilege 2972 WMIC.exe Token: SeBackupPrivilege 2972 WMIC.exe Token: SeRestorePrivilege 2972 WMIC.exe Token: SeShutdownPrivilege 2972 WMIC.exe Token: SeDebugPrivilege 2972 WMIC.exe Token: SeSystemEnvironmentPrivilege 2972 WMIC.exe Token: SeRemoteShutdownPrivilege 2972 WMIC.exe Token: SeUndockPrivilege 2972 WMIC.exe Token: SeManageVolumePrivilege 2972 WMIC.exe Token: 33 2972 WMIC.exe Token: 34 2972 WMIC.exe Token: 35 2972 WMIC.exe Token: SeBackupPrivilege 2812 vssvc.exe Token: SeRestorePrivilege 2812 vssvc.exe Token: SeAuditPrivilege 2812 vssvc.exe Token: SeIncreaseQuotaPrivilege 2080 WMIC.exe Token: SeSecurityPrivilege 2080 WMIC.exe Token: SeTakeOwnershipPrivilege 2080 WMIC.exe Token: SeLoadDriverPrivilege 2080 WMIC.exe Token: SeSystemProfilePrivilege 2080 WMIC.exe Token: SeSystemtimePrivilege 2080 WMIC.exe Token: SeProfSingleProcessPrivilege 2080 WMIC.exe Token: SeIncBasePriorityPrivilege 2080 WMIC.exe Token: SeCreatePagefilePrivilege 2080 WMIC.exe Token: SeBackupPrivilege 2080 WMIC.exe Token: SeRestorePrivilege 2080 WMIC.exe Token: SeShutdownPrivilege 2080 WMIC.exe Token: SeDebugPrivilege 2080 WMIC.exe Token: SeSystemEnvironmentPrivilege 2080 WMIC.exe Token: SeRemoteShutdownPrivilege 2080 WMIC.exe Token: SeUndockPrivilege 2080 WMIC.exe Token: SeManageVolumePrivilege 2080 WMIC.exe Token: 33 2080 WMIC.exe Token: 34 2080 WMIC.exe Token: 35 2080 WMIC.exe Token: SeIncreaseQuotaPrivilege 2080 WMIC.exe - Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2412 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 17 PID 3028 wrote to memory of 2412 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 17 PID 3028 wrote to memory of 2412 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 17 PID 3028 wrote to memory of 2240 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 30 PID 3028 wrote to memory of 2240 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 30 PID 3028 wrote to memory of 2240 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 30 PID 3028 wrote to memory of 2356 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 21 PID 3028 wrote to memory of 2356 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 21 PID 3028 wrote to memory of 2356 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 21 PID 3028 wrote to memory of 1420 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 19 PID 3028 wrote to memory of 1420 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 19 PID 3028 wrote to memory of 1420 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 19 PID 2240 wrote to memory of 2972 2240 cmd.exe 22 PID 2240 wrote to memory of 2972 2240 cmd.exe 22 PID 2240 wrote to memory of 2972 2240 cmd.exe 22 PID 1420 wrote to memory of 1860 1420 cmd.exe 27 PID 1420 wrote to memory of 1860 1420 cmd.exe 27 PID 1420 wrote to memory of 1860 1420 cmd.exe 27 PID 2356 wrote to memory of 2016 2356 cmd.exe 26 PID 2356 wrote to memory of 2016 2356 cmd.exe 26 PID 2356 wrote to memory of 2016 2356 cmd.exe 26 PID 2412 wrote to memory of 1740 2412 cmd.exe 23 PID 2412 wrote to memory of 1740 2412 cmd.exe 23 PID 2412 wrote to memory of 1740 2412 cmd.exe 23 PID 3028 wrote to memory of 3000 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 45 PID 3028 wrote to memory of 3000 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 45 PID 3028 wrote to memory of 3000 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 45 PID 3028 wrote to memory of 2192 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 47 PID 3028 wrote to memory of 2192 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 47 PID 3028 wrote to memory of 2192 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 47 PID 3028 wrote to memory of 380 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 49 PID 3028 wrote to memory of 380 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 49 PID 3028 wrote to memory of 380 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 49 PID 3028 wrote to memory of 896 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 51 PID 3028 wrote to memory of 896 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 51 PID 3028 wrote to memory of 896 3028 9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe 51 PID 3000 wrote to memory of 1844 3000 cmd.exe 52 PID 3000 wrote to memory of 1844 3000 cmd.exe 52 PID 3000 wrote to memory of 1844 3000 cmd.exe 52 PID 2192 wrote to memory of 2080 2192 cmd.exe 54 PID 2192 wrote to memory of 2080 2192 cmd.exe 54 PID 2192 wrote to memory of 2080 2192 cmd.exe 54 PID 380 wrote to memory of 1624 380 cmd.exe 55 PID 380 wrote to memory of 1624 380 cmd.exe 55 PID 380 wrote to memory of 1624 380 cmd.exe 55 PID 896 wrote to memory of 1724 896 cmd.exe 56 PID 896 wrote to memory of 1724 896 cmd.exe 56 PID 896 wrote to memory of 1724 896 cmd.exe 56 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe"C:\Users\Admin\AppData\Local\Temp\9243bdcbe30fbd430a841a623e9e1bcc894e4fdc136d46e702a94dad4b10dfdc.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1740
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit / set{ default } bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\system32\bcdedit.exebcdedit / set{ default } bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:1860
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit / set{ default } recoveryenabled No2⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\system32\bcdedit.exebcdedit / set{ default } recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:2016
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wmic SHADOWCOPY DELETE2⤵
- Suspicious use of WriteProcessMemory
PID:2240
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1844
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wmic SHADOWCOPY DELETE2⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\System32\Wbem\WMIC.exewmic SHADOWCOPY DELETE3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2080
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit / set{ default } recoveryenabled No2⤵
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Windows\system32\bcdedit.exebcdedit / set{ default } recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:1624
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit / set{ default } bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\system32\bcdedit.exebcdedit / set{ default } bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:1724
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic SHADOWCOPY DELETE1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2972
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2812
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Adobe\WhatHappened.txt
- Size 1KB
- SHA256 f058bc2a88431119f286f2708751f25449dc1d58e1c87de3bb38aff764c814a8
- MD5 b05e32b7e78e82f01f6f0c7d1411ee67
- SHA1 2e1dda46f8561858b378d19a24b839062f794274
- SHA512 6cb7c842a48b9f982ac87280ded95e206e2b9055f9f51ea84f6060470a61a35decbb688650c0d6b7c318df018078af0c0a1afe0ce65db1b460d75ae7800e2d3c
- MD5 SHA1 SHA512