Analysis
-
max time kernel
145s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27-05-2024 01:02
Behavioral task
behavioral1
Sample
wtava.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
wtava.exe
Resource
win10v2004-20240426-en
General
-
Target
wtava.exe
-
Size
1.1MB
-
MD5
6c660f960daac148be75427c712d0134
-
SHA1
b3c597060abc20d3b3291f8b5252a3834d49b92f
-
SHA256
fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6
-
SHA512
48806df9787497cbf55a85a523c8e703aec1bb262c60a019ab45f420a87d016054a97dc428484bd5c2f7ba1c3f57a37d807fc4e1de487dbef1c76dc38fbf8fe0
-
SSDEEP
24576:du13Ii3FoHjrdVIxpxJbpvR+h8O+DB8lll7IbbbbpcMs:du3IDHjrdVIxpxhe8O68Ll7IbbbbpcM
Malware Config
Extracted
C:\Users\Admin\Desktop\251664-readme.html
avaddon
Signatures
-
Avaddon
Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.
-
Avaddon payload 1 IoCs
resource yara_rule behavioral2/files/0x0008000000023423-530.dat family_avaddon -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wtava.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wtava.exe -
Renames multiple (173) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
pid Process 3720 wtava.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\wtava.exe" wtava.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\wtava.exe" wtava.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wtava.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-3906287020-2915474608-1755617787-1000\desktop.ini wtava.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: wtava.exe File opened (read-only) \??\U: wtava.exe File opened (read-only) \??\W: wtava.exe File opened (read-only) \??\J: wtava.exe File opened (read-only) \??\K: wtava.exe File opened (read-only) \??\M: wtava.exe File opened (read-only) \??\P: wtava.exe File opened (read-only) \??\A: wtava.exe File opened (read-only) \??\N: wtava.exe File opened (read-only) \??\O: wtava.exe File opened (read-only) \??\R: wtava.exe File opened (read-only) \??\T: wtava.exe File opened (read-only) \??\V: wtava.exe File opened (read-only) \??\Y: wtava.exe File opened (read-only) \??\B: wtava.exe File opened (read-only) \??\E: wtava.exe File opened (read-only) \??\G: wtava.exe File opened (read-only) \??\H: wtava.exe File opened (read-only) \??\F: wtava.exe File opened (read-only) \??\Z: wtava.exe File opened (read-only) \??\I: wtava.exe File opened (read-only) \??\L: wtava.exe File opened (read-only) \??\S: wtava.exe File opened (read-only) \??\X: wtava.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 11 api.myip.com 12 api.myip.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe 4592 wtava.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3484 wmic.exe Token: SeSecurityPrivilege 3484 wmic.exe Token: SeTakeOwnershipPrivilege 3484 wmic.exe Token: SeLoadDriverPrivilege 3484 wmic.exe Token: SeSystemProfilePrivilege 3484 wmic.exe Token: SeSystemtimePrivilege 3484 wmic.exe Token: SeProfSingleProcessPrivilege 3484 wmic.exe Token: SeIncBasePriorityPrivilege 3484 wmic.exe Token: SeCreatePagefilePrivilege 3484 wmic.exe Token: SeBackupPrivilege 3484 wmic.exe Token: SeRestorePrivilege 3484 wmic.exe Token: SeShutdownPrivilege 3484 wmic.exe Token: SeDebugPrivilege 3484 wmic.exe Token: SeSystemEnvironmentPrivilege 3484 wmic.exe Token: SeRemoteShutdownPrivilege 3484 wmic.exe Token: SeUndockPrivilege 3484 wmic.exe Token: SeManageVolumePrivilege 3484 wmic.exe Token: 33 3484 wmic.exe Token: 34 3484 wmic.exe Token: 35 3484 wmic.exe Token: 36 3484 wmic.exe Token: SeIncreaseQuotaPrivilege 3096 wmic.exe Token: SeSecurityPrivilege 3096 wmic.exe Token: SeTakeOwnershipPrivilege 3096 wmic.exe Token: SeLoadDriverPrivilege 3096 wmic.exe Token: SeSystemProfilePrivilege 3096 wmic.exe Token: SeSystemtimePrivilege 3096 wmic.exe Token: SeProfSingleProcessPrivilege 3096 wmic.exe Token: SeIncBasePriorityPrivilege 3096 wmic.exe Token: SeCreatePagefilePrivilege 3096 wmic.exe Token: SeBackupPrivilege 3096 wmic.exe Token: SeRestorePrivilege 3096 wmic.exe Token: SeShutdownPrivilege 3096 wmic.exe Token: SeDebugPrivilege 3096 wmic.exe Token: SeSystemEnvironmentPrivilege 3096 wmic.exe Token: SeRemoteShutdownPrivilege 3096 wmic.exe Token: SeUndockPrivilege 3096 wmic.exe Token: SeManageVolumePrivilege 3096 wmic.exe Token: 33 3096 wmic.exe Token: 34 3096 wmic.exe Token: 35 3096 wmic.exe Token: 36 3096 wmic.exe Token: SeIncreaseQuotaPrivilege 4840 wmic.exe Token: SeSecurityPrivilege 4840 wmic.exe Token: SeTakeOwnershipPrivilege 4840 wmic.exe Token: SeLoadDriverPrivilege 4840 wmic.exe Token: SeSystemProfilePrivilege 4840 wmic.exe Token: SeSystemtimePrivilege 4840 wmic.exe Token: SeProfSingleProcessPrivilege 4840 wmic.exe Token: SeIncBasePriorityPrivilege 4840 wmic.exe Token: SeCreatePagefilePrivilege 4840 wmic.exe Token: SeBackupPrivilege 4840 wmic.exe Token: SeRestorePrivilege 4840 wmic.exe Token: SeShutdownPrivilege 4840 wmic.exe Token: SeDebugPrivilege 4840 wmic.exe Token: SeSystemEnvironmentPrivilege 4840 wmic.exe Token: SeRemoteShutdownPrivilege 4840 wmic.exe Token: SeUndockPrivilege 4840 wmic.exe Token: SeManageVolumePrivilege 4840 wmic.exe Token: 33 4840 wmic.exe Token: 34 4840 wmic.exe Token: 35 4840 wmic.exe Token: 36 4840 wmic.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4592 wrote to memory of 3484 4592 wtava.exe 86 PID 4592 wrote to memory of 3484 4592 wtava.exe 86 PID 4592 wrote to memory of 3484 4592 wtava.exe 86 PID 4592 wrote to memory of 3096 4592 wtava.exe 90 PID 4592 wrote to memory of 3096 4592 wtava.exe 90 PID 4592 wrote to memory of 3096 4592 wtava.exe 90 PID 4592 wrote to memory of 4840 4592 wtava.exe 92 PID 4592 wrote to memory of 4840 4592 wtava.exe 92 PID 4592 wrote to memory of 4840 4592 wtava.exe 92 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wtava.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wtava.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" wtava.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\wtava.exe"C:\Users\Admin\AppData\Local\Temp\wtava.exe"1⤵
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4592 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3484
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3096
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4840
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\wtava.exeC:\Users\Admin\AppData\Roaming\Microsoft\wtava.exe1⤵
- Executes dropped EXE
PID:3720
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD56c660f960daac148be75427c712d0134
SHA1b3c597060abc20d3b3291f8b5252a3834d49b92f
SHA256fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6
SHA51248806df9787497cbf55a85a523c8e703aec1bb262c60a019ab45f420a87d016054a97dc428484bd5c2f7ba1c3f57a37d807fc4e1de487dbef1c76dc38fbf8fe0
-
Filesize
50KB
MD560e0c33580d5780b4e65b33e52f5b3c1
SHA15c794c8957a7c2893850ddbea8bee0fbb0284ecc
SHA2567633a7d6d0bfbd15ae35f3a848cbffb87a21888feb5ccde3b6da4ec151b8e055
SHA512acde5191209e7ed94c1f5babbff1e7a45f77923fe78ac2e309944dba0310ef57e64bcc6ef768b29c346290a2e61c2c2e361510fa0edb287b422981e78355dacf