a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4

max time kernel
130s
max time network
91s
platform
windows10-1703_x64
resource
win10-20240319-en
resource tags

arch:x64arch:x86image:win10-20240319-enlocale:en-usos:windows10-1703-x64system
submitted
13-04-2024 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe
Size

483KB
MD5

3265b2b0afc6d2ad0bdd55af8edb9b37
SHA1

24272beb676d956ec8a65b95a2615c9075fa9869
SHA256

a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4
SHA512

28f99da799b43a5fd060b5cab411911b54ceeb51e612ec6213c2b8003ee6de29bc46683ba04507c0e8a92e9fbec4be5cecbc8918618db9c15f231a5be806cb94
SSDEEP

12288:JF+dRkCGjzKd5Ik6ZDEyyq8Me0KzYB3IvClBTn:JF+deC2+d5AZLde0KcBU4BT

Score

9^/10

persistence ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Loads dropped DLL 1 IoCs

Processes:

a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe

pid	Process
4896	a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3971934951-2222591486-1444465656-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mouse Application = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe"	a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe

description	ioc	Process
File opened (read-only)	\??\G:	a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe
File opened (read-only)	\??\H:	a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe
File opened (read-only)	\??\I:	a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe
File opened (read-only)	\??\J:	a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
1	api.ipify.org

Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Proxy
T1090
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
4212	4896	WerFault.exe	72

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exe

pid	Process
388	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe

pid	Process
4896	a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe
4896	a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

Processes:

WMIC.exevssvc.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4476	WMIC.exe
Token: SeSecurityPrivilege	4476	WMIC.exe
Token: SeTakeOwnershipPrivilege	4476	WMIC.exe
Token: SeLoadDriverPrivilege	4476	WMIC.exe
Token: SeSystemProfilePrivilege	4476	WMIC.exe
Token: SeSystemtimePrivilege	4476	WMIC.exe
Token: SeProfSingleProcessPrivilege	4476	WMIC.exe
Token: SeIncBasePriorityPrivilege	4476	WMIC.exe
Token: SeCreatePagefilePrivilege	4476	WMIC.exe
Token: SeBackupPrivilege	4476	WMIC.exe
Token: SeRestorePrivilege	4476	WMIC.exe
Token: SeShutdownPrivilege	4476	WMIC.exe
Token: SeDebugPrivilege	4476	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4476	WMIC.exe
Token: SeRemoteShutdownPrivilege	4476	WMIC.exe
Token: SeUndockPrivilege	4476	WMIC.exe
Token: SeManageVolumePrivilege	4476	WMIC.exe
Token: 33	4476	WMIC.exe
Token: 34	4476	WMIC.exe
Token: 35	4476	WMIC.exe
Token: 36	4476	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4476	WMIC.exe
Token: SeSecurityPrivilege	4476	WMIC.exe
Token: SeTakeOwnershipPrivilege	4476	WMIC.exe
Token: SeLoadDriverPrivilege	4476	WMIC.exe
Token: SeSystemProfilePrivilege	4476	WMIC.exe
Token: SeSystemtimePrivilege	4476	WMIC.exe
Token: SeProfSingleProcessPrivilege	4476	WMIC.exe
Token: SeIncBasePriorityPrivilege	4476	WMIC.exe
Token: SeCreatePagefilePrivilege	4476	WMIC.exe
Token: SeBackupPrivilege	4476	WMIC.exe
Token: SeRestorePrivilege	4476	WMIC.exe
Token: SeShutdownPrivilege	4476	WMIC.exe
Token: SeDebugPrivilege	4476	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4476	WMIC.exe
Token: SeRemoteShutdownPrivilege	4476	WMIC.exe
Token: SeUndockPrivilege	4476	WMIC.exe
Token: SeManageVolumePrivilege	4476	WMIC.exe
Token: 33	4476	WMIC.exe
Token: 34	4476	WMIC.exe
Token: 35	4476	WMIC.exe
Token: 36	4476	WMIC.exe
Token: SeBackupPrivilege	784	vssvc.exe
Token: SeRestorePrivilege	784	vssvc.exe
Token: SeAuditPrivilege	784	vssvc.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.execmd.execmd.exe

description	pid	Process	procid_target
PID 4896 wrote to memory of 3864	4896	a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe	73
PID 4896 wrote to memory of 3864	4896	a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe	73
PID 4896 wrote to memory of 3864	4896	a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe	73
PID 4896 wrote to memory of 4596	4896	a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe	75
PID 4896 wrote to memory of 4596	4896	a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe	75
PID 4896 wrote to memory of 4596	4896	a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe	75
PID 3864 wrote to memory of 388	3864	cmd.exe	76
PID 3864 wrote to memory of 388	3864	cmd.exe	76
PID 3864 wrote to memory of 388	3864	cmd.exe	76
PID 4596 wrote to memory of 4476	4596	cmd.exe	80
PID 4596 wrote to memory of 4476	4596	cmd.exe	80
PID 4596 wrote to memory of 4476	4596	cmd.exe	80

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe
"C:\Users\Admin\AppData\Local\Temp\a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C schtasks /Create /SC MINUTE /TN "Mouse Application" /TR "C:\Users\Admin\AppData\Local\Temp\a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Create /SC MINUTE /TN "Mouse Application" /TR "C:\Users\Admin\AppData\Local\Temp\a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:388
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C wmic SHADOWCOPY DELETE & wbadmin DELETE SYSTEMSTATEBACKUP & bcdedit.exe / set{ default } bootstatuspolicy ignoreallfailures & bcdedit.exe / set{ default } recoveryenabled No
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic SHADOWCOPY DELETE
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 1824
  2⤵
  - Program crash
  PID:4212

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:784

C:\Users\Admin\AppData\Local\Temp\a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe
C:\Users\Admin\AppData\Local\Temp\a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe
1⤵
PID:656

C:\Users\Admin\AppData\Local\Temp\a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe
C:\Users\Admin\AppData\Local\Temp\a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe
1⤵
PID:2712

C:\Users\Admin\AppData\Local\Temp\a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe
C:\Users\Admin\AppData\Local\Temp\a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe
1⤵
PID:312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Proxy

T1090

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.log

Filesize
658B

MD5
7f72d544deb72afb01a16a38ab558b03

SHA1
f45872c1cd924de792661eec694d41bf6b8e3440

SHA256
6a2eb4f9420e59bc4c59799cf49f3ce4d2869c2b7aa45900391fd236737a8cbc

SHA512
40979064dca61224ac5b754ee671f37cd0e0f3c85f92f986c46af11416ff001ce69daf11daf8582c837ab4b94e637ae2ce5d106eb75060ee72acefdffc5e048c

Download Submit
\Users\Admin\AppData\Local\Temp\tor-lib.dll

Filesize
38KB

MD5
dc7e564809d6c2a2f3457c3c9b91f22b

SHA1
f28c63fc7ac58162c27428a179d2113200814e7e

SHA256
9969c1e4cf32d1fe6140d6fabf63b6b093a6c6ff7045a187b14175d46cfb74a0

SHA512
f37a46895062318aef808c65bd2a074c8177b6e90f9368aae1892db837f7962c4ed1d75ba34c533895f096d3d71b56aecdb6eafbf61b3ecd50b0d4e8c79021f0

Download Submit