Analysis
-
max time kernel
122s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28-01-2024 19:25
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe
Resource
win7-20231215-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe
-
Size
216KB
-
MD5
005cd35ae3c5d9c94da09408ad5a2e9f
-
SHA1
0b2489d0b6cffe82d995cc3682cd338dcbd46ba1
-
SHA256
28a0c6fe558e50b9d711b83913310fa8fb9937674c5b8980ed88ff7f1399abd9
-
SHA512
dbcc5decfcd9e08c9fc195e77e93765f090846a5a37f731eabba1c9fdb64471d6ed6d656ae9884b129b75fe1dd30fa5d70deb914a403caf5142e2d534a2ec31a
-
SSDEEP
3072:m17DaAz38w3vM7F6PFwgBZTGFKQ+avVe+gGooSlFC2OLKKZAFEMpo4Iv1k:Gb81F6Pf2KQ+aVB2fJqh4Id
Score
9/10
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (298) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\M:\$RECYCLE.BIN\S-1-5-21-3308111660-3636268597-2291490419-1000\desktop.ini 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe File opened (read-only) \??\R: 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe File opened (read-only) \??\A: 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe File opened (read-only) \??\H: 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe File opened (read-only) \??\J: 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe File opened (read-only) \??\X: 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe File opened (read-only) \??\B: 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe File opened (read-only) \??\M: 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe File opened (read-only) \??\W: 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe File opened (read-only) \??\T: 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe File opened (read-only) \??\Y: 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe File opened (read-only) \??\I: 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe File opened (read-only) \??\O: 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe File opened (read-only) \??\G: 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe File opened (read-only) \??\L: 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe File opened (read-only) \??\V: 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe File opened (read-only) \??\E: 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe File opened (read-only) \??\U: 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe File opened (read-only) \??\S: 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe File opened (read-only) \??\K: 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe File opened (read-only) \??\Z: 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe File opened (read-only) \??\N: 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe File opened (read-only) \??\Q: 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe -
Modifies boot configuration data using bcdedit 4 IoCs
pid Process 2248 bcdedit.exe 2696 bcdedit.exe 2332 bcdedit.exe 1664 bcdedit.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\readme.bmp" 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2952 vssadmin.exe 1724 vssadmin.exe -
Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Control Panel\Desktop\WallpaperStyle = "0" 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Control Panel\Desktop\TileWallpaper = "0" 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2960 WMIC.exe Token: SeSecurityPrivilege 2960 WMIC.exe Token: SeTakeOwnershipPrivilege 2960 WMIC.exe Token: SeLoadDriverPrivilege 2960 WMIC.exe Token: SeSystemProfilePrivilege 2960 WMIC.exe Token: SeSystemtimePrivilege 2960 WMIC.exe Token: SeProfSingleProcessPrivilege 2960 WMIC.exe Token: SeIncBasePriorityPrivilege 2960 WMIC.exe Token: SeCreatePagefilePrivilege 2960 WMIC.exe Token: SeBackupPrivilege 2960 WMIC.exe Token: SeRestorePrivilege 2960 WMIC.exe Token: SeShutdownPrivilege 2960 WMIC.exe Token: SeDebugPrivilege 2960 WMIC.exe Token: SeSystemEnvironmentPrivilege 2960 WMIC.exe Token: SeRemoteShutdownPrivilege 2960 WMIC.exe Token: SeUndockPrivilege 2960 WMIC.exe Token: SeManageVolumePrivilege 2960 WMIC.exe Token: 33 2960 WMIC.exe Token: 34 2960 WMIC.exe Token: 35 2960 WMIC.exe Token: SeIncreaseQuotaPrivilege 2960 WMIC.exe Token: SeSecurityPrivilege 2960 WMIC.exe Token: SeTakeOwnershipPrivilege 2960 WMIC.exe Token: SeLoadDriverPrivilege 2960 WMIC.exe Token: SeSystemProfilePrivilege 2960 WMIC.exe Token: SeSystemtimePrivilege 2960 WMIC.exe Token: SeProfSingleProcessPrivilege 2960 WMIC.exe Token: SeIncBasePriorityPrivilege 2960 WMIC.exe Token: SeCreatePagefilePrivilege 2960 WMIC.exe Token: SeBackupPrivilege 2960 WMIC.exe Token: SeRestorePrivilege 2960 WMIC.exe Token: SeShutdownPrivilege 2960 WMIC.exe Token: SeDebugPrivilege 2960 WMIC.exe Token: SeSystemEnvironmentPrivilege 2960 WMIC.exe Token: SeRemoteShutdownPrivilege 2960 WMIC.exe Token: SeUndockPrivilege 2960 WMIC.exe Token: SeManageVolumePrivilege 2960 WMIC.exe Token: 33 2960 WMIC.exe Token: 34 2960 WMIC.exe Token: 35 2960 WMIC.exe Token: SeBackupPrivilege 1184 vssvc.exe Token: SeRestorePrivilege 1184 vssvc.exe Token: SeAuditPrivilege 1184 vssvc.exe Token: SeIncreaseQuotaPrivilege 2280 WMIC.exe Token: SeSecurityPrivilege 2280 WMIC.exe Token: SeTakeOwnershipPrivilege 2280 WMIC.exe Token: SeLoadDriverPrivilege 2280 WMIC.exe Token: SeSystemProfilePrivilege 2280 WMIC.exe Token: SeSystemtimePrivilege 2280 WMIC.exe Token: SeProfSingleProcessPrivilege 2280 WMIC.exe Token: SeIncBasePriorityPrivilege 2280 WMIC.exe Token: SeCreatePagefilePrivilege 2280 WMIC.exe Token: SeBackupPrivilege 2280 WMIC.exe Token: SeRestorePrivilege 2280 WMIC.exe Token: SeShutdownPrivilege 2280 WMIC.exe Token: SeDebugPrivilege 2280 WMIC.exe Token: SeSystemEnvironmentPrivilege 2280 WMIC.exe Token: SeRemoteShutdownPrivilege 2280 WMIC.exe Token: SeUndockPrivilege 2280 WMIC.exe Token: SeManageVolumePrivilege 2280 WMIC.exe Token: 33 2280 WMIC.exe Token: 34 2280 WMIC.exe Token: 35 2280 WMIC.exe Token: SeIncreaseQuotaPrivilege 2280 WMIC.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 1728 wrote to memory of 2796 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 29 PID 1728 wrote to memory of 2796 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 29 PID 1728 wrote to memory of 2796 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 29 PID 1728 wrote to memory of 2188 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 30 PID 1728 wrote to memory of 2188 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 30 PID 1728 wrote to memory of 2188 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 30 PID 1728 wrote to memory of 2700 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 31 PID 1728 wrote to memory of 2700 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 31 PID 1728 wrote to memory of 2700 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 31 PID 1728 wrote to memory of 2300 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 32 PID 1728 wrote to memory of 2300 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 32 PID 1728 wrote to memory of 2300 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 32 PID 2700 wrote to memory of 2248 2700 cmd.exe 37 PID 2700 wrote to memory of 2248 2700 cmd.exe 37 PID 2700 wrote to memory of 2248 2700 cmd.exe 37 PID 2188 wrote to memory of 2960 2188 cmd.exe 40 PID 2188 wrote to memory of 2960 2188 cmd.exe 40 PID 2188 wrote to memory of 2960 2188 cmd.exe 40 PID 2300 wrote to memory of 2696 2300 cmd.exe 38 PID 2300 wrote to memory of 2696 2300 cmd.exe 38 PID 2300 wrote to memory of 2696 2300 cmd.exe 38 PID 2796 wrote to memory of 2952 2796 cmd.exe 39 PID 2796 wrote to memory of 2952 2796 cmd.exe 39 PID 2796 wrote to memory of 2952 2796 cmd.exe 39 PID 1728 wrote to memory of 472 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 47 PID 1728 wrote to memory of 472 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 47 PID 1728 wrote to memory of 472 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 47 PID 1728 wrote to memory of 680 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 49 PID 1728 wrote to memory of 680 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 49 PID 1728 wrote to memory of 680 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 49 PID 1728 wrote to memory of 588 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 51 PID 1728 wrote to memory of 588 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 51 PID 1728 wrote to memory of 588 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 51 PID 1728 wrote to memory of 884 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 52 PID 1728 wrote to memory of 884 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 52 PID 1728 wrote to memory of 884 1728 0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe 52 PID 472 wrote to memory of 1724 472 cmd.exe 53 PID 472 wrote to memory of 1724 472 cmd.exe 53 PID 472 wrote to memory of 1724 472 cmd.exe 53 PID 680 wrote to memory of 2280 680 cmd.exe 56 PID 680 wrote to memory of 2280 680 cmd.exe 56 PID 680 wrote to memory of 2280 680 cmd.exe 56 PID 588 wrote to memory of 2332 588 cmd.exe 57 PID 588 wrote to memory of 2332 588 cmd.exe 57 PID 588 wrote to memory of 2332 588 cmd.exe 57 PID 884 wrote to memory of 1664 884 cmd.exe 58 PID 884 wrote to memory of 1664 884 cmd.exe 58 PID 884 wrote to memory of 1664 884 cmd.exe 58 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe"C:\Users\Admin\AppData\Local\Temp\0ab68d9216c85e6ddd00ff80c9c441349b3d43f15d76fa4256e70f3585a84240.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2952
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wmic SHADOWCOPY DELETE2⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\System32\Wbem\WMIC.exewmic SHADOWCOPY DELETE3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2960
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit / set{ default } recoveryenabled No2⤵
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\system32\bcdedit.exebcdedit / set{ default } recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:2248
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit / set{ default } bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\system32\bcdedit.exebcdedit / set{ default } bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2696
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1724
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wmic SHADOWCOPY DELETE2⤵
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Windows\System32\Wbem\WMIC.exewmic SHADOWCOPY DELETE3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2280
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit / set{ default } recoveryenabled No2⤵
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Windows\system32\bcdedit.exebcdedit / set{ default } recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:2332
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit / set{ default } bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\system32\bcdedit.exebcdedit / set{ default } bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:1664
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1184