Analysis

  • max time kernel
    136s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    24-04-2024 20:09

General

  • Target

    b70cd51a8dcc9e0d2e6478e28d715b836a0fa25d72ba1a7329efd2f02e2ab463.dll

  • Size

    156KB

  • MD5

    17335dec0444e9d28eb598a43dfd7597

  • SHA1

    64b02895625770dbaa63448e0add4aaa4421059a

  • SHA256

    b70cd51a8dcc9e0d2e6478e28d715b836a0fa25d72ba1a7329efd2f02e2ab463

  • SHA512

    b8c282b7aaca67d90802439f65e4811c092343afebcffb03b5357d002917422dd29e43c7296279ae4562e49f044eefae6ab7aca94bfc7cb6128a804090b4e2b3

  • SSDEEP

    3072:V1k7CoJRaj4TJbVbYU7RgnFJjBnCjc9UPN:VKjXT/aMQg

Score
10/10

Malware Config

Signatures

  • Locky

    Ransomware strain released in 2016, with advanced features like anti-analysis.

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies Control Panel 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\b70cd51a8dcc9e0d2e6478e28d715b836a0fa25d72ba1a7329efd2f02e2ab463.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2008
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\b70cd51a8dcc9e0d2e6478e28d715b836a0fa25d72ba1a7329efd2f02e2ab463.dll,#1
      2⤵
      • Sets desktop wallpaper using registry
      • Modifies Control Panel
      • Suspicious use of WriteProcessMemory
      PID:2120
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\_WHAT_is.html
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2572
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2572 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2520
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2996
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {76A8622A-6293-47DD-9E5F-F4C1E2842013} S-1-5-18:NT AUTHORITY\System:Service:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2504
    • C:\Windows\system32\vssadmin.exe
      C:\Windows\system32\vssadmin.exe Delete Shadows /Quiet /All
      2⤵
      • Interacts with shadow copies
      PID:1036
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:2904

Network

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

2
T1112

Discovery

System Information Discovery

1
T1082

Impact

Inhibit System Recovery

2
T1490

Defacement

1
T1491

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\_4_WHAT_is.html
    Filesize

    8KB

    MD5

    6894b075f8f179ba1342e051beea2e18

    SHA1

    eb6e10be2adc956ee16f9c1e68da50e26979e70c

    SHA256

    7bb226c2d18a01678ea95c3614a0cfe064013fa26f19c492e261a817c2775179

    SHA512

    775897c42ac02451a711923c1bdccc27663988405532afe038fb420d723aa3d74b877a1bb33f0a487580ae6addc6a7f1b2fe49cb7f899811752822b94dcb5e83

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    304B

    MD5

    2d2afed0f0651cbeb3a5ce7b757aa0e8

    SHA1

    7b470262ad42e2d24ea12a3a460ff66f1a5632a1

    SHA256

    14890217b2e7439c82024e75da22b333e21749c36fd075781b084a8cf21a301a

    SHA512

    f8c4a40e76250ec3591f9e405ee7f2cd16b738a94c72eca124f10bc06006c027242ca7b199b3f78b1472dae953e17386cfc0ff56d3118eedceb2dcbc1230a111

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    304B

    MD5

    943f45654f3b219dc4cac393e735112f

    SHA1

    10ec0dbf1f6ac7ee004cc5dd2c62449d99d6a69f

    SHA256

    f313cdc8867b4c4ce95b480e44bea1b42c89462af60bcea24cf0b6407902bee1

    SHA512

    2d0c0f8c3ea583845cdcf01664a0838091b29fde0e3eae38e8a30ff24272ca83654ecd5ac81d543c4ea7d974557193f3a897627c6236f21eb125fd3ecc6ad79e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    304B

    MD5

    4326a3e24561e31b79df53a14eaad7bf

    SHA1

    e1b6e278a3e38dc5cd6aee773febe0e3ec5355b1

    SHA256

    44587fe957ead50e2db90596f08a51f01eff42b9aa9c4115cbb5aceea3573f67

    SHA512

    e1353fa7bf7ad9a0414549920491a6c67735e9104d991ddea89142cadbfcdd6d3c7757689d9e5faa8eb2d749085ab59350f48aa86ee4442e0db557736e2501fc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    304B

    MD5

    94becd21e1b9e769b2ab1351ce49b6a9

    SHA1

    94a4e4ab198567b3e38394f68a184d1d2ece3335

    SHA256

    22b7381780dccd8dbd63e958ac8fd6b73cb1627cf42acad21df13d9cda636bc0

    SHA512

    aeb38d45f0b5873f9b9b873e400e96cdb9fd575d189a72b1a7c803d84b67a60f795f33f748ead0dad4e51f010c01d531b559f922d4133dbbf9dc31d07d216916

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    304B

    MD5

    b48624737eefc85eeb4fe20b7912b464

    SHA1

    a50b00861e46d0f0a9a708d3432448bfa77b24fc

    SHA256

    ec16fd7421edd696e566aedf95ae54ceb9b162bc70640fbf362e3d84a0ab7d8b

    SHA512

    3ec2a906a7dbe3fec60aaf37832fdf8f85b2ddc4932bc894a884eff98588a16b4cdc30f73c2ff9d96cb156b7500c10301f20920cd6f467d56d21893024f653d2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    304B

    MD5

    a7ca68f38bc6c87e59bf3edfd2428a53

    SHA1

    9886c5f59da438a69d0dc41335ffaca175732aa2

    SHA256

    ad7141c1dd04f3d7fdebafd80d0469cf3d7f1db1477ee64d0ddc127d3643c3f1

    SHA512

    d596084dc5815233d29eb42e9fd5834f9053db06af6c724f4a38415e9610ce4e98268b0dbff7eca6fb27d517f33fb7227794fa9d82a9ffa2c1a4c5cda3219e98

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    304B

    MD5

    ea67cda8783e778499679bdc246705ca

    SHA1

    2d41e0be1975fc0672e911e94002512b85a00307

    SHA256

    34e7c96a499c06ddeb1a40bfe5052e699a4b7cb839667560d9e5bada0611a56a

    SHA512

    69683d5316ecdf26d86a89d78b6ee4ccce64800d2d4897f367143e739fd728e1ef917ad8e356d77bd5779a2c9a96b2ffbd53398b0d78bcfa46c01252da5cb296

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    304B

    MD5

    ed303d8c0e9113bacc3f9a4b3bc8a0c9

    SHA1

    5d522fb5bcca2a31a72044aa9967565e42741ba7

    SHA256

    ab9a29c2e8a658a2d2dc1ecdc66223d691bf710a20cd42af5594bb6254ec148b

    SHA512

    9224c76b4a88baabc4998043d68f0d3fe8eb8f843a8c54e573f9da10c47f26159951f4afcb6e9237a09dc74f4d90f2bf89e85722588b68f0bf1e850f3106a028

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    304B

    MD5

    3a32ea49a0ff63a1ad08a4b84d219ef0

    SHA1

    aa0a206d46817b0ac7d9d41ac1609f0826542c56

    SHA256

    13d7fd93c4d5c067143e49c807bd91b55399880a8f7a92415b3c1034f1ea4d00

    SHA512

    61c9cb8dd43e21b7f984f3bd890e464fbe70381a43ec4b7d336fb71e035b563d38c699364870036c0fe2f2bcbbf974317a066d0db68ca7b84d6e59951052153f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    304B

    MD5

    3c44008704e0db02e8e67284d07e92e1

    SHA1

    0587181da6537351ef9b6f02642504b118583df1

    SHA256

    9c65ebd5b69b72212a4657ef224cc72aa5fe3a62df345b31824d04e19b14837a

    SHA512

    84884704d028dea0d71efc769cf5fddea3f97bb178a42e628d597da5b11e04408c9781aba59cb4678d7c742bea24552aa4f871effc4cf1bb8c5f634ab2d44fff

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    304B

    MD5

    1da4d1ce844a269cabe9e1bb824d9a15

    SHA1

    2f6646b1ec829bf3530e61950352b7b6684f1621

    SHA256

    9bbb65b78650e804a2b53c7778d15c9075d4b87c09330781e0a819a7f1a8dd36

    SHA512

    e7d765600e1c45f2f0da8801b7054d0dc19f056ca280f8c327c6d83a7f517e7303f7b0f4ad41b720780cb0931fe0b7a8e69510ca57e4d19737a6707ea4a5fb05

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    304B

    MD5

    081806a0ad706e48f3ba82508dc8ef22

    SHA1

    d60edebfd9943d4875deb38cd2ccf0e653c8e897

    SHA256

    1259e18d57f1f3c69f2e57953f98df66d44a0e3ed85dabeb2829730b86fc56cd

    SHA512

    72063c41e2ef4138636a9e75c30bbb6e5da630f08dde964939631adde347e12d04156c1b0d55d27fe4123827fa12158c159c2665c911c43019ed171b11be8faf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    304B

    MD5

    3634035009bced6a402ae748a24513c8

    SHA1

    a43c17bbb80fa744e9e29a162a7a8f06f4158864

    SHA256

    e03f6e05b8512de7679491338d747ff72fd26787f65605eaa25579ce1c528353

    SHA512

    2b34e8c0a468efd9514f9ba5104dfc37ee0b10c032ec27d1548a938724f31de4b2210c1035f6c067baf1c7e4737cc5df2ac6a9281c24c02646b28570cf740d65

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    304B

    MD5

    ce19808d9f7af990c73b76c8ee7a0c24

    SHA1

    240cad52c06eb949a1580d6d844920c6a2accb3f

    SHA256

    d4f8545107f7ff0e84098d18397229c9a77b605d9e8ccf52d289e0cd297c447a

    SHA512

    d08d9e4bfea88a44e404e00507a5a45f8a080c059d2e47a5301c5b570b267859d95f209ddce055276eda4c5a56c500d00a94813d04b4ad61b6f415cfb188af38

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    304B

    MD5

    c2108a00619ace9edb14cec834e54645

    SHA1

    ead05706bc0d025851b229e419a67d52735250df

    SHA256

    929be4dbedf460893ff3d123428cdf936ea35ed90c8db919a5950dcc475fb423

    SHA512

    ec725b8f64458481b84cd462d49a6f95e78b9ff3ba4de2e1f370503da6789294f7e40c8357c7065c618fac71037c8d21dffa43acd47d9bc1aa71d7c79b52b348

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    304B

    MD5

    9d4904b80bd8de4a183cd67c518aa551

    SHA1

    6d07c3ab836db7988887a61333889e324c21269d

    SHA256

    d15ed8fdbcbdc599eb641c38046b61c3711bf141c0fa11a9f0dbf0df2ea21e71

    SHA512

    7f6554fd60f80b5a65ec2cc69769716875dbacf8e431794098d855e8b90c1d1c3425ee33a80e3e5117baec300d64a0556b65e4e24a3385be453568c2119b4611

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    304B

    MD5

    f4a8d10ab24a1d5be844022117425325

    SHA1

    882d63733651f9808f2bf974ad0718bafa339839

    SHA256

    67b0ba6f34bbaa27d424f3759e083aba08bff3087deea535f9e9cc2163b8031a

    SHA512

    b3505902be1d7533a77ea96678bc3ad6b7f2ed6f1ac8b5de4f71008f1c5a0416989c4a71c52a26319c75685d4047d7296a954e53bad4230033b3a4ca0d3d4819

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    304B

    MD5

    f26b1e93e839b7ac8eb905bdeff74e21

    SHA1

    9428f86d3e29ab56473f57940d118c445299a85b

    SHA256

    97bf74c9b834febcf554cda901dc6ae366d0dfb4b368b49674e302b86855785c

    SHA512

    8ae2f4149a5f04476f506bd36db1afc50bacbf41d93e4eb8fd8f891a9626eb676cd5dee2df5a59cd0d2d2b194faf1e87c8cd813c4c8e28b49cf0a7ff3bdb9432

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    304B

    MD5

    a2f10dde61d7c998c37ff4539fbd84aa

    SHA1

    e10a7eb3ef1f2c8783ca66aa8d75967658b2c3d4

    SHA256

    c13df32e33dbe0a11d7f7661bc9454549f6348eb98f1303ae2f7b6c24596864f

    SHA512

    95fc9d2c108587023ed06fb167d62eb935c995cae92c958188d735ecbaf71a3dc5fa1c404efb232fb856a8d63c7bbc39c4b0a659bfb6f2db06773e15dee236c6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    304B

    MD5

    23e0e8260e4f0d19523c5944c7ff1889

    SHA1

    c31b53309fd1a1b937b8d09db918f6df53295360

    SHA256

    e1c5e1c69df988832270ba8e506c1e74a1e91074274f195c1d75f2ae02997955

    SHA512

    5d094dd37006a23ec46ee7edf05a54b13d6e6a5610b20497aa878d8746a2e9e3202b6ff1cf2fc2121552cd96ea226dd47d74dab27044b1655b30181fdead012d

  • C:\Users\Admin\AppData\Local\Temp\CabDDB5.tmp
    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\TarE01C.tmp
    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

  • C:\Users\Admin\Desktop\_WHAT_is.bmp
    Filesize

    3.1MB

    MD5

    eb098ff2b1829b5a3c2a9f032e23cfea

    SHA1

    715d1466d435dec483d15c479d02c0c48f447c03

    SHA256

    5494a10b3ff1341bd7b70ecae3ef6eb06c69b45103d6577a5724d93c07df9624

    SHA512

    c689f3d1301cd1ce97f2a7b32794171f9fa3ff9085054dd18bfbb6fab1d693f6a1c588daf1c1e2f915ab7e440caf581a3c1a97942ffda9a9346326cf2826a01a

  • memory/2120-6-0x0000000000130000-0x000000000016D000-memory.dmp
    Filesize

    244KB

  • memory/2120-8-0x0000000000180000-0x0000000000182000-memory.dmp
    Filesize

    8KB

  • memory/2120-0-0x0000000000120000-0x000000000015D000-memory.dmp
    Filesize

    244KB

  • memory/2120-326-0x0000000000A40000-0x0000000000A42000-memory.dmp
    Filesize

    8KB

  • memory/2120-4-0x0000000000130000-0x000000000016D000-memory.dmp
    Filesize

    244KB

  • memory/2120-3-0x0000000000180000-0x0000000000182000-memory.dmp
    Filesize

    8KB

  • memory/2120-2-0x0000000000130000-0x000000000016D000-memory.dmp
    Filesize

    244KB

  • memory/2120-1-0x0000000000120000-0x000000000015D000-memory.dmp
    Filesize

    244KB

  • memory/2904-805-0x00000000001F0000-0x00000000001F1000-memory.dmp
    Filesize

    4KB

  • memory/2904-327-0x0000000000170000-0x0000000000172000-memory.dmp
    Filesize

    8KB

  • memory/2904-328-0x00000000001F0000-0x00000000001F1000-memory.dmp
    Filesize

    4KB