1cae96dace01ef11ea003250d3cd9f9519821eff90e781fb6d179051ae7060fd

General

Target

2024-05-23_6de4046f30c513f2907cfb8bcecd2eb5_cryptowall.exe
Size

129KB
MD5

6de4046f30c513f2907cfb8bcecd2eb5
SHA1

b382c47dc850dbb314224d29b83c454f42f4fbef
SHA256

1cae96dace01ef11ea003250d3cd9f9519821eff90e781fb6d179051ae7060fd
SHA512

6b13d1c553cc7d7555ae618c25d752a9315017e79de90cf9abdfc845f7c3dcbdd9d7d2a709da13e9c9fb2dbbd6483870dcbbff42f58e3d3f7545bc77223698d3
SSDEEP

3072:nhRpa+zd/EtzAAZ1rMAKlyDjH/B6SVqCgQfBUnPy8L66iiSB:nhbrdEt8ADrZDjH/B6SVqCgQfBUPy8Lu

Score

9^/10

defense_evasion execution impact persistence ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Drops startup file 1 IoCs

Processes:

explorer.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b6fc3871.exe explorer.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b6fc3871.exe	explorer.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\b6fc387 = "C:\\b6fc3871\\b6fc3871.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*6fc387 = "C:\\b6fc3871\\b6fc3871.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\b6fc3871 = "C:\\Users\\Admin\\AppData\\Roaming\\b6fc3871.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*6fc3871 = "C:\\Users\\Admin\\AppData\\Roaming\\b6fc3871.exe"	explorer.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 ip-addr.es
5 myexternalip.com
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

3052 vssadmin.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

2024-05-23_6de4046f30c513f2907cfb8bcecd2eb5_cryptowall.exeexplorer.exe

pid process

2064 2024-05-23_6de4046f30c513f2907cfb8bcecd2eb5_cryptowall.exe
1892 explorer.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 2612 vssvc.exe
Token: SeRestorePrivilege 2612 vssvc.exe
Token: SeAuditPrivilege 2612 vssvc.exe

flow	ioc
3	ip-addr.es
5	myexternalip.com

pid	process
3052	vssadmin.exe

pid	process
2064	2024-05-23_6de4046f30c513f2907cfb8bcecd2eb5_cryptowall.exe
1892	explorer.exe

description	pid	process
Token: SeBackupPrivilege	2612	vssvc.exe
Token: SeRestorePrivilege	2612	vssvc.exe
Token: SeAuditPrivilege	2612	vssvc.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

2024-05-23_6de4046f30c513f2907cfb8bcecd2eb5_cryptowall.exeexplorer.exe

description	pid	process	target process
PID 2064 wrote to memory of 1892	2064	2024-05-23_6de4046f30c513f2907cfb8bcecd2eb5_cryptowall.exe	explorer.exe
PID 2064 wrote to memory of 1892	2064	2024-05-23_6de4046f30c513f2907cfb8bcecd2eb5_cryptowall.exe	explorer.exe
PID 2064 wrote to memory of 1892	2064	2024-05-23_6de4046f30c513f2907cfb8bcecd2eb5_cryptowall.exe	explorer.exe
PID 2064 wrote to memory of 1892	2064	2024-05-23_6de4046f30c513f2907cfb8bcecd2eb5_cryptowall.exe	explorer.exe
PID 1892 wrote to memory of 2732	1892	explorer.exe	svchost.exe
PID 1892 wrote to memory of 2732	1892	explorer.exe	svchost.exe
PID 1892 wrote to memory of 2732	1892	explorer.exe	svchost.exe
PID 1892 wrote to memory of 2732	1892	explorer.exe	svchost.exe
PID 1892 wrote to memory of 3052	1892	explorer.exe	vssadmin.exe
PID 1892 wrote to memory of 3052	1892	explorer.exe	vssadmin.exe
PID 1892 wrote to memory of 3052	1892	explorer.exe	vssadmin.exe
PID 1892 wrote to memory of 3052	1892	explorer.exe	vssadmin.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-05-23_6de4046f30c513f2907cfb8bcecd2eb5_cryptowall.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_6de4046f30c513f2907cfb8bcecd2eb5_cryptowall.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2064

C:\Windows\syswow64\explorer.exe
"C:\Windows\syswow64\explorer.exe"
2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\syswow64\svchost.exe
-k netsvcs
3⤵
PID:2732

C:\Windows\syswow64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
3⤵
- Interacts with shadow copies
PID:3052

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1

T1047

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

2

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
180b891ab8382fb412a7f1871d29bfec

SHA1
d08afd54243f4ee920176e7b70221d1a47ec27e3

SHA256
46a63bad3e9bc162bfd69ab1e9ab78a042e7854072d9930735aad94f581f7a4d

SHA512
c9ede9b3fa5b8c36f43654910c5bdbe567ba53cce237e7268890ea5d701a35e60968dd617fa914462bdc9d140d5c5e30935e41fd008a3776384f5d534b13dc05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da4934a3c053c5acaa6c9134fe325aac

SHA1
76775c3124f4f6c6e48e9a058adc2777759c4207

SHA256
86bbc8f651108560397fbd299b0f603f5f25341f14f093c573e3e70e7a235c07

SHA512
ce36d64bb72e50b8ee6f66df7eca4bb9a5f5b710f477cb76d02164443aabdbe6378122583babefedc0748c9bb67d87c6931fdbda6f3fe40e4e177535aad31cd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2A2E.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2A31.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
memory/1892-0-0x0000000000080000-0x00000000000A5000-memory.dmp

Filesize
148KB

Download
memory/1892-1-0x0000000000080000-0x00000000000A5000-memory.dmp

Filesize
148KB

Download
memory/2732-7-0x0000000000080000-0x00000000000A5000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads