Analysis
- max time kernel
148s - max time network
118s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
30/05/2024, 05:14
General
- Target 994f26fa6a2a8b6748ed2a1c4c0ec3b4e8ff60417f7992eb568555d4c9d08044.exe
- Size 282KB
- Sample240530-fw2jjsgh44
- SHA256 994f26fa6a2a8b6748ed2a1c4c0ec3b4e8ff60417f7992eb568555d4c9d08044
Malware Config
Extracted
-
C:\Users\Admin\Desktop\How To Decrypt.txt
- Blaze Ransomware Your data are stolen and encrypted The data will be published on TOR website http://imugmohnfb6akqz7jb6rqjusiwgnthjgm37mjygondgkwwyw3hwudkqd.onion if you do not pay the ransom You can contact us and decrypt one file for free. [email protected] Caution!! Do not modify encrypted files, otherwise you may lose all your files forever!
-
http://imugmohnfb6akqz7jb6rqjusiwgnthjgm37mjygondgkwwyw3hwudkqd.onion
Signatures
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Renames multiple (185) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\994f26fa6a2a8b6748ed2a1c4c0ec3b4e8ff60417f7992eb568555d4c9d08044.exe"C:\Users\Admin\AppData\Local\Temp\994f26fa6a2a8b6748ed2a1c4c0ec3b4e8ff60417f7992eb568555d4c9d08044.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
How To Decrypt.txt
memory/2940-0-0x0000000000400000-0x0000000000432000-memory.dmp
memory/2940-5-0x0000000000400000-0x0000000000432000-memory.dmp
memory/2940-2-0x0000000001F70000-0x0000000001FAC000-memory.dmp
memory/2940-6-0x0000000001FB0000-0x0000000001FB1000-memory.dmp
memory/2940-4-0x0000000000400000-0x0000000000432000-memory.dmp
memory/2940-3-0x0000000000414000-0x0000000000415000-memory.dmp
memory/2940-7-0x0000000000400000-0x0000000000432000-memory.dmp
memory/2940-1-0x0000000000400000-0x0000000000432000-memory.dmp
memory/2940-258-0x0000000000400000-0x0000000000432000-memory.dmp
memory/2940-259-0x0000000001F70000-0x0000000001FAC000-memory.dmp