Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
04/02/2024, 12:11
General
-
Target
VirusShare_060d41f75055ed0ffd43a408e6a5801e.exe
-
Size
345KB
-
MD5
060d41f75055ed0ffd43a408e6a5801e
-
SHA1
96a466c5dbc7e4a10257afb3bd8b790f965084d9
-
SHA256
34e1b92e38659dd6407c5065a3dd0cd8b791b182af5eaeb26b2a4573bc2177ea
-
SHA512
663cd0f6d73fd7a91a6b7058c201bfe8f6797c94b90f1690119ad7b80f560e8f913143ed8e46c8efcf5d1450aa4eb5b69a0ad1ffc2646fe86f53fc96ecb014ff
-
SSDEEP
6144:44oibXfchTduH5Gwqp5ASxhJq94C1ORG+v4igk72RC/kVp4uOebbkYCDG:NjbMQk5AOhJFGBmkVpvnkYz
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\restore_files_gqslo.txt
http://kwe2342fsd.rt546sdf234re.com/C68DEB6FF2815B2D
http://awoeinf832as.wo49i277rnw.com/C68DEB6FF2815B2D
https://kb63vhjuk3wh4ex7.onion.to/C68DEB6FF2815B2D
http://kb63vhjuk3wh4ex7.onion/C68DEB6FF2815B2D
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\restore_files_gqslo.html
https://kb63vhjuk3wh4ex7.onion.to/C68DEB6FF2815B2D</a>
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (350) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_060d41f75055ed0ffd43a408e6a5801e.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_060d41f75055ed0ffd43a408e6a5801e.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\vcwpdy.exeC:\Users\Admin\AppData\Roaming\vcwpdy.exe2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE >> NUL2⤵
- Deletes itself
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD54c54ef41f34b8f7f18b3ad208d00b927
SHA1299a0048481bf50a4462b25b8fbefcd73ef94b42
SHA256363ba881d4fa1fccc05d91f12a23f52430aae0f1788a705217d684e858bbee6d
SHA512748cf44ba798a3a2ec75dbf0f9b0acf943bdd2d3b761ec27c58b597a792c9156d8efa2a0838449574b6287afe4e453bee48fac2c28841925f16596d9a95b35be
-
Filesize
2KB
MD5e26b60979f6f2c4f02dc76f7d5749db9
SHA1fc70868b12d7d5aec9231b92e6cc89701c503322
SHA256f784a4a6493755229620cfbcd3eab0f31f520dab37c84b304ec11461590d801c
SHA512fea41514f253d5411701cb20aedf48114d6aa77f161f22a99aa2c79866c8a480bd5c09736d63a9e7dabab88172f417c9660223928e698338e7e0d3634b2bfcd7
-
Filesize
344B
MD522b75f72198a902413942be3abf2325b
SHA171df514c1ec8039b275ef820abaf3154bbb19fe1
SHA2566869e354f2f5a9a0b0b11d3b6601a760155315844de39f51666fce0217490aee
SHA5124f82c2d55472dcd536681ded6d34f9efe231876d500191911cdb2d0932c273cad7a1db06ba40b473a9f303bc1e9b308338f587c89f0ffea64ff8415224fbab05
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
345KB
MD5060d41f75055ed0ffd43a408e6a5801e
SHA196a466c5dbc7e4a10257afb3bd8b790f965084d9
SHA25634e1b92e38659dd6407c5065a3dd0cd8b791b182af5eaeb26b2a4573bc2177ea
SHA512663cd0f6d73fd7a91a6b7058c201bfe8f6797c94b90f1690119ad7b80f560e8f913143ed8e46c8efcf5d1450aa4eb5b69a0ad1ffc2646fe86f53fc96ecb014ff
-
Filesize
1.6MB
-
Filesize
12KB
-
Filesize
16KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
16KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB