ee65e9d7a7bc9d17e894e0b775fc0bbfb35e72c65c3d768e34bfe059d521cc16

Resubmissions

21-01-2024 14:52

240121-r8syqaeac7 10

21-01-2024 14:51

240121-r8k8waeac5 10

01-01-2024 13:55

240101-q776kscacp 10

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21-01-2024 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe
Size

352KB
MD5

4f88b5e510ecbd0adefdfc87c552289c
SHA1

047ec67b8e3c001086284d7176b2d239db565fb5
SHA256

b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273
SHA512

75b86d6de4bec5285559f7e9a0dbf46df48dbdf78386023e5f8668a7814bc1db5322d8bf9d306cfd65175112b94366641d671175d59d3edacc3d2b2ba802f348
SSDEEP

6144:X9PrHO8306KFnBCzDIZXY3HJmui45mkA2/1:drHBpgkDuoEuXbJ

Score

9^/10

persistence ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Executes dropped EXE 1 IoCs

pid	Process
2656	dwa01.exe

Loads dropped DLL 2 IoCs

pid	Process
1752	b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe
1752	b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\{67B97992-033F-589A-AA66-FFC16ECB2C0C} = "C:\\Users\\Admin\\AppData\\Roaming\\dwa01.exe"	b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2544	vssadmin.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	2520	vssvc.exe
Token: SeRestorePrivilege	2520	vssvc.exe
Token: SeAuditPrivilege	2520	vssvc.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2656	1752	b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe	28
PID 1752 wrote to memory of 2656	1752	b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe	28
PID 1752 wrote to memory of 2656	1752	b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe	28
PID 1752 wrote to memory of 2656	1752	b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe	28
PID 2656 wrote to memory of 2604	2656	dwa01.exe	34
PID 2656 wrote to memory of 2604	2656	dwa01.exe	34
PID 2656 wrote to memory of 2604	2656	dwa01.exe	34
PID 2656 wrote to memory of 2604	2656	dwa01.exe	34
PID 2656 wrote to memory of 2632	2656	dwa01.exe	33
PID 2656 wrote to memory of 2632	2656	dwa01.exe	33
PID 2656 wrote to memory of 2632	2656	dwa01.exe	33
PID 2656 wrote to memory of 2632	2656	dwa01.exe	33
PID 2656 wrote to memory of 2580	2656	dwa01.exe	31
PID 2656 wrote to memory of 2580	2656	dwa01.exe	31
PID 2656 wrote to memory of 2580	2656	dwa01.exe	31
PID 2656 wrote to memory of 2580	2656	dwa01.exe	31
PID 2604 wrote to memory of 2544	2604	cmd.exe	35
PID 2604 wrote to memory of 2544	2604	cmd.exe	35
PID 2604 wrote to memory of 2544	2604	cmd.exe	35
PID 2604 wrote to memory of 2544	2604	cmd.exe	35

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe
"C:\Users\Admin\AppData\Local\Temp\b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Users\Admin\AppData\Roaming\dwa01.exe
  "C:\Users\Admin\AppData\Roaming\dwa01.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:2580
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:2632
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin Delete Shadows /All /Quiet
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin Delete Shadows /All /Quiet
      4⤵
      Interacts with shadow copies
      PID:2544

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\dwa01.exe

Filesize
300KB

MD5
fdf80e6cfcc0b4746577622c9bec27e3

SHA1
bc0362794d9fdf3fe149f383855cb556220c2cb2

SHA256
4a8b26be61f2d052a7b94a2beb6563a4f19230ce7397dfe5f07901c00a9c4053

SHA512
a84210ae0180815590f94b609f68f9834448c48bce205f05c1e1f189a6b0ad729c0145a58a9da41b14521a510104f52cb89c8e35cc80baec935cf9a67dad2867

Download Submit
C:\Users\Admin\AppData\Roaming\dwa01.exe

Filesize
352KB

MD5
4f88b5e510ecbd0adefdfc87c552289c

SHA1
047ec67b8e3c001086284d7176b2d239db565fb5

SHA256
b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273

SHA512
75b86d6de4bec5285559f7e9a0dbf46df48dbdf78386023e5f8668a7814bc1db5322d8bf9d306cfd65175112b94366641d671175d59d3edacc3d2b2ba802f348

Download Submit
C:\Users\Admin\AppData\Roaming\dwa01.exe

Filesize
115KB

MD5
dd8d3d0db59d86ca5d52b37c3f2b4cb8

SHA1
94d97515a7721974588d06f910a0add6159b810c

SHA256
3a25c7c4c98179d1fb5c228e19459cbd70dfa229ff81bef2d8d97e5dd83f814a

SHA512
d3146e36e4bc1de09efe1b58853c7e2b711f7a388bff1ce1c2bfb01e17fed551c4aa9658520ddb8bcf0553b3d94c5a01e0268f4ea3156b286ad18a1dd7058582

Download Submit
\Users\Admin\AppData\Roaming\dwa01.exe

Filesize
293KB

MD5
72bffe57f26ffda92d225c30a6735e84

SHA1
a1f852c6e1fd35470c333210e184d21e7349fd9b

SHA256
17da52eaeae1e470f7b1ccbf1236e07ff01cb59e255c4ec4356dbb7681880a52

SHA512
c500111f9470bf4c21e728c73868254388d5c7dec10a2367705aec46fd6fd6b378b01a542014259c450bb20036d316f63066e9c74837b3c71efe0e519e5d4f23

Download Submit
memory/1752-0-0x00000000021B0000-0x0000000002219000-memory.dmp

Filesize
420KB

Download
memory/1752-1-0x0000000001F20000-0x0000000001F21000-memory.dmp

Filesize
4KB

Download
memory/1752-3-0x0000000003FE0000-0x0000000004010000-memory.dmp

Filesize
192KB

Download
memory/1752-2-0x0000000001F20000-0x0000000001F21000-memory.dmp

Filesize
4KB

Download
memory/2656-23-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/2656-24-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/2656-25-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/2656-26-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/2656-27-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/2656-28-0x0000000004120000-0x0000000004150000-memory.dmp

Filesize
192KB

Download
memory/2656-38-0x0000000004120000-0x0000000004150000-memory.dmp

Filesize
192KB

Download
memory/2656-22-0x0000000001FA0000-0x0000000002009000-memory.dmp

Filesize
420KB

Download
memory/2656-40-0x0000000004120000-0x0000000004150000-memory.dmp

Filesize
192KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads