Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
10-06-2024 21:55
General
-
Target
VirusShare_c9ef69554082be3467df433a15e7ab45.exe
-
Size
321KB
-
MD5
c9ef69554082be3467df433a15e7ab45
-
SHA1
79c01bf85a712ddf6a4d54e9db281a8310a12c15
-
SHA256
0db818ad2b03a8003c1b923985b3cd74ed82272205b3372796b192d2661824ac
-
SHA512
13d818b734a9ee2d1cd2bda66ae6213f7fb7e9a74f0175ae37b85906816341e6224cdf1d5f57487e21b80d9782cee75db8acbd3752a303569fc8c6fa2598a4f9
-
SSDEEP
6144:cL42La41ctAaWLBbYcTDASiBdRIGt4MCZnsdbTo07BTT9OyIO:I42LasctABLBz/Udu04MEnsdbTo01VO8
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\restore_files_smlkd.txt
http://qw2234duoiyu.h2fyr6785jhdhfg.com/5C6A369C2E66856
http://awoeinf832as.wo49i277rnw.com/5C6A369C2E66856
https://kb63vhjuk3wh4ex7.onion.to/5C6A369C2E66856
http://kb63vhjuk3wh4ex7.onion/5C6A369C2E66856
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\restore_files_smlkd.html
https://kb63vhjuk3wh4ex7.onion.to/5C6A369C2E66856</a>
Signatures
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (427) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies Internet Explorer settings 1 TTPs 36 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 32 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_c9ef69554082be3467df433a15e7ab45.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_c9ef69554082be3467df433a15e7ab45.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\vcwxtc.exeC:\Users\Admin\AppData\Roaming\vcwxtc.exe2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RESTORE_FILES.TXT3⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RESTORE_FILES.HTML3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2644 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Roaming\vcwxtc.exe >> NUL3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE >> NUL2⤵
- Deletes itself
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD56cdf8a9780a219d6ce74083ee3f2d285
SHA1c47bd2b835981516b9c369b4d48bd0081a595f9a
SHA2569f81fa262176f9e3443017e0aae6aba3c746088df679123dc8c1f49385a0dee5
SHA51217a8882d2ac4b0e456fc77d130f36ef8ea4125484361e2095ad510dc3f337fdfcfbf232d901befcb09337f78822b5ceab6e927bd8cd3942b2a70f8e513d465cc
-
Filesize
2KB
MD59e9f54af655e6a6b45dfab9498a0bfaa
SHA1b6772ffd5678ec85f0f16c14cda58b85730fb75d
SHA2562737b00992e7ca2515b45d754ff493e3b6637a68c73f66b2ab645e0a087d2fba
SHA5123711d4337838d1b9f52670bf30da6b622ba2424106c57f98d081765619abf577c118f45d1651bc71235cef95c9f375ca70207ced0dc6efc4c5b789b525dec975
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
Filesize
252B
MD5367ecd59605b4eb5d5c8376be1a913bb
SHA1250dd50863b292f0101befbe2dc7e373b2dcde15
SHA2569f40c75ab9466ab95844236a83932e16b2cc2c892b22fc3c6619b8071028d850
SHA512192e9c6f6ab524c97ea8918665eeb5459b9b96b80343225a5cd5157a9d7418f6035529c0dc4c4fe8174392c4a46732454d985d2f02e0528b2d7a0e301da62beb
-
Filesize
342B
MD5e86f24c4dd2c1ccef3f83b2de7002cf2
SHA1673909cb859256a47b6ce2d535ed19cfaac5ef70
SHA256d6f004008e9576757281911a224f8687951644e466cc3bc48572f46fad6d52e0
SHA512eaae6ad5c38e654e4a13933d275cc8d5184f3cbe1c2a91039a25ea925949342d829a2e4151cb715a2a49131aeb33ee007a88107acebdc5c958ab45911bc1d13c
-
Filesize
342B
MD55d7512367bbdb71e846433885d6dd778
SHA1ad6e1acf2b7824c6b58e28e6ee44069b125a8808
SHA256fcbd69e5aa1ac512a43a2f75ae5eeadb07e5b03adab69b0a6136759621ef725a
SHA512c2e6c07f215caa7b2f14a22d289df4b8f23176bfa134292e74c1e8c2cf38f281a5a07d1a28287a6e91cab9a4a0622a7cb26c91c3ae90099c0cfb01220ae84472
-
Filesize
342B
MD50aa95f5b588e59f58725699e234ba995
SHA1b981cc87aac5ca8aa31e8c6467965fe9c408816f
SHA256e17da3620c039e1e53b30dc3c6a584603ec7a8ec0f973e4bf0c532a770e7e830
SHA512b5d673ef7a20068ba5db2eab58328332a0ce193e6749de7b27f88060c01a5100b5d0fd60460a991971937e4866648cc4b65c0295104ed4af8fa321767288ce92
-
Filesize
342B
MD5ebe1de0858e559f00f63a94f247b3553
SHA175c91d454c1c6a51ec661fcf49eb095910b92ea3
SHA256e297451d49bd7cffb5344dee8b9c9cf0c25a636a278a14b85aefe164e5072ece
SHA512fc1291d73ede66dbc1607b87fe156a99387c490fc1776d58ffb4f3ad64e20c21f0d2beb270a0ca5305820cd2468d7f39a4868d7cc3271e974da292cbd09b011f
-
Filesize
342B
MD54f7b357b439971bd1da318d83cb40dec
SHA10198db1600d402faf7b7772177e48252263d6cd3
SHA256e8a1825924bf6c0ca468a78dbabaf95ecf1957a96a9f1fb5b7716db6bea6bcb4
SHA5127289e65e25d262de696d132e2c928ccbf18c0454bc02a04aeac28a48cb3709407d6ddbd64e4e3556000d78cd6c1195ce80ca93de58990175f865af04e72f4c5c
-
Filesize
342B
MD588a55c85381815f73cf68c426d3edcad
SHA16bb871e2736014ca7d69b4cb9f8be973b2e1f37d
SHA25641d36823c47cdc01917e719d14d9b8fb6c47184ea03d24db1e08366019406ad9
SHA512eb5aec67d26f92eceef69f6608279edf85b2bd39357902b72aa789e922236cba5581100f77f66375c04145e6fb532211a4f91cd30e5bd83c891b8f89288c051c
-
Filesize
342B
MD54d4af9db45bb2f67793a0cbd5c8c93b6
SHA127da09079f44d40b760073b6bf1083895a5129a4
SHA256dff074c309009e34bf2789d6da498c0e39ad79d2d9bed1e20d6b4b6996ee1fca
SHA5121d0c77649ade8c24089e9bb5ee6fc43d5e25d9d395dedc957ad9c2eb1ec983850e2da056d03e162ee0ad6ab44812d025106fa9795217d54217308f42c7afa453
-
Filesize
342B
MD5312f3776e6e6a9be91aebf75c66c7a9a
SHA1b82c108c3ebb97eef42641a3091b6144223e4916
SHA25602768c07f70af510666cf3d1aba358054511f1a5ecf869722ab093a646dbd918
SHA512bde174ddd0e2149243ce467550605c3e4bafce10ed4a054344bba9ce8198bf7e556dd13fd5e37c1a9360ed92f85cd0ab8ccb1601b197a958ed393e8c6f49f116
-
Filesize
342B
MD5f6d989b7597801b778d8042ee363a58b
SHA1ff36bfbb493a68487e206cb57271602fb95e5450
SHA2564821d58beba120488cd77ed6b9e7bd5d0682001a6c99fe1cf5da452cda91b071
SHA512d94e72c1f96297091f85a8afe5398c963d295f1286d213ed320e3cf4610ae6be442c6d6b225352bd55ba43b434c604007b229640b3ce4f8d4b9e596369e5bcd8
-
Filesize
342B
MD5fd2aae7d39c9d957594b5bd503f6fea9
SHA18c611e9dc3085da63588263128924d70526da58c
SHA2565e1bd6adb2108485e43c672dd630c9c87f04a94e9eae4b037198082b6d80a1f2
SHA5124e7f556aa674be635079f4b27a9a1215bd0ac2c956cb1a036e59330b620d1838fe78a331d10fe1c97e46cb4243f41762b6691d7a83271b9e5d3f1631c6da9ff7
-
Filesize
342B
MD5eeb198b8091ea9b368d5fb69a10adb9d
SHA1cb0818e7732678b8b6640b96566945add15a2411
SHA25614b4899e18d0da77ef09cf90753d09f399fd1b9996e6c6ac62aa44e2f7a8b539
SHA512bb0555fa57afd7bd348622779624af4a7d1ebc4be9968bcda72326d3e060d2de10a44ad9ed1fb98016148a202866f79e60c40f0c574a667feff92fdb0cf839e6
-
Filesize
342B
MD544335ab5728c3e32fe7cc0128e47dd38
SHA1d9f0fe1ddf4b2dc9816acb7043b8975d796fa17e
SHA25653e3a963e0b22197422980da41614690bcbc670c049796e35ed8b7a292678ded
SHA5127d6220319365d75d754dd18f954a2f13acab5a067c09de5ddff13d278b5c6965626cd65de6b91ec1d31825783ff8e64610a8c157b26b5a9c62faae815a76b126
-
Filesize
342B
MD512327ec1a2651bdd5b0dc65e47bd5402
SHA1413e712e0ee109cee55da517118a982d94c66da8
SHA2568a1038187c9a5f17df4eb42e06a3cd4cd097901edbf837ca2582e01365ee912b
SHA5121ac25b4326926e1f76ccb1108ff3fa0db3783c2f79b995243d3a093e25ba4e15d1303d25919de1135312cb14557afd4873c316f5642b50708248bf244b529b12
-
Filesize
342B
MD578188c655daa6b81e733bd29a4d9b41a
SHA1249748369f9722979b0e0a93fd0d628ad0a7e3f3
SHA25628ff8151ebae83f648aec28999078413401d2b0c9bfdefcc606f47fb012d0d30
SHA5127f1bf53b951dcfb6cdcb45e4bf48aa91c8cd6e1acd6d19d84504a8f19b262c6be729bd4e0fe7dbd2d53977009dfa63c48ce8d86886451d8382c3c3ee9d992405
-
Filesize
342B
MD54b965563b9b58c88080dd8b8e8c476d9
SHA11913587fbf01a204607173b6c30fa1784a692d4c
SHA256051ea5123aee6a3bce260ff164a17a94b74bcfe068be934718c1ebb702782c80
SHA5121ccbaae19f6b1946aa2b628f65c5b78a536165f8b8fc533313c9b1333339a86f676e39a8431f6ec08f22afa8b3a3d81441d2f62b65c5551170968fc73d3b724a
-
Filesize
342B
MD571c437a9431adc11f1d97b76be40970a
SHA197c8d25fb1400a0da5bee77577291c247ac80396
SHA2561e502e694ed9cc463d68a422a6dbc63a024985ecff55235dd632f21d59d8865a
SHA5121b6f3924d8f9efec2e2171d1175f2069e8002ad1e11c9cc67b2fd412f640066ba2331e679da9776bfeb06290558e2a7e71ab400d453c595ecb07a7261d404c6f
-
Filesize
342B
MD5cf1ce53285ea39ccd9a17300ee37bd86
SHA1c4179d9d369724b4209552a25cf0c7d7077ac7e7
SHA2564753b8f75306905e4a05117f9b1157d05f705ab449d7d61456826afd43ac6768
SHA51227a269189f61e09879f0936ddf3a405ac3b8201edf74452521a473b4e97a98490f269f82ac5f0255f421b09e9f8caef6cb024eb1c3023882a3c9c603fce81854
-
Filesize
342B
MD51a6c3546321e858e8ee5a7caab8e332a
SHA1da0d0f90e95019c58c0ab3844215c2a3e51bf1b1
SHA25672ea84c537af091c6db6374ad3e0dfd1dcc661667016fbcb73d123bf2c2832ad
SHA512f2cfa963159f878e719c64a186d13a315b20ef431ade64237f44a5663e2ffda04d029b56b22fc5d834999b664394c33c8bf46980ca907a995f5301ce40d7dbd5
-
Filesize
342B
MD5d19695381f316c7a0ca2b4ff09c75a0a
SHA16b135c0b80d12b5ae7651d3f4300791d28aaec4d
SHA256d84dd1e41cf7df12ad37c33cc016069930b4efdd32a0c0aae2e53107b0a4c0c1
SHA512770670259772d18f80f78c2327b9b508da8f3835b08373e0c3a56cea8fa2c66ca93318df048f6d83340170f40fb56ceecc7dd6fb2716bb9bb05827e83f7e926e
-
Filesize
242B
MD50a469087eb300a66d8cb490d17a547a7
SHA1711bc8728a1a16357e5c39ac4f2b2545b25e5425
SHA256ec441c8c015fecae27413a851ba244056712cdb8fbb1d75b62506f645619bde3
SHA512484357b9c730be5951636b5cdd8ff99f465458efdd99df526f0ac630d9b77f48f86292e5185cbd92d23f427d767e78e7fc2941b54c561a0326034ed8b772cd6d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
2.3MB
MD5df820c4374474666271a73132de656dc
SHA184962b7acf08f6822e6e7564f1f89ebdac1dd27f
SHA2564ac01d60532587964d88d26fdec43945e9fa318493e63e6fedd6ae982342d230
SHA512e3bd2894364245f985009ffd914cb67d86686d1e66bd568f2b91ace30be4d4d42038dc16ec266fed374390c1d2814a50eeff80924495b4d8440196af75849b26
-
Filesize
321KB
MD5c9ef69554082be3467df433a15e7ab45
SHA179c01bf85a712ddf6a4d54e9db281a8310a12c15
SHA2560db818ad2b03a8003c1b923985b3cd74ed82272205b3372796b192d2661824ac
SHA51213d818b734a9ee2d1cd2bda66ae6213f7fb7e9a74f0175ae37b85906816341e6224cdf1d5f57487e21b80d9782cee75db8acbd3752a303569fc8c6fa2598a4f9
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
8KB
-
Filesize
2.6MB
-
Filesize
16KB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
8KB
-
Filesize
12KB
-
Filesize
16KB
-
Filesize
2.6MB
-
Filesize
2.6MB
