Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
10-06-2024 10:41
General
-
Target
VirusShare_1449cdc2acb385e8326dfd0364e67d25.exe
-
Size
339KB
-
MD5
1449cdc2acb385e8326dfd0364e67d25
-
SHA1
27ec595e01e4c89fb17a895bced8b84871355df4
-
SHA256
7007b16d76f879588fbbaef6ed77de0be778d38b09ace3740d50068937334dab
-
SHA512
d660379a13c169ca0690a64cf5427d75ca71030e61bcc2795d6ddbd41d21028b453487c170db74303aa6c2c76d188272c8f6ad049ac4e579c6aaf738590d8c0b
-
SSDEEP
6144:Y9Jy1mYCrFLXOppiFWDKvZBjtgnbEufzKB/xL4lkY:YvyUYsXWpiVztebEWz+Z4eY
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\restore_files_ljtvu.txt
http://lk2gaflsgh.jgy658snfyfnvh.com/7ADE2A589D2A591
http://dg62wor94m.sdsfg834mfuuw.com/7ADE2A589D2A591
https://djdkduep62kz4nzx.onion.to/7ADE2A589D2A591
http://djdkduep62kz4nzx.onion/7ADE2A589D2A591
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\restore_files_ljtvu.html
https://djdkduep62kz4nzx.onion.to/7ADE2A589D2A591</a>
Signatures
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (363) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies Internet Explorer settings 1 TTPs 36 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 32 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_1449cdc2acb385e8326dfd0364e67d25.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_1449cdc2acb385e8326dfd0364e67d25.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\vcwnfb.exeC:\Users\Admin\AppData\Roaming\vcwnfb.exe2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RESTORE_FILES.TXT3⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RESTORE_FILES.HTML3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Roaming\vcwnfb.exe >> NUL3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE >> NUL2⤵
- Deletes itself
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD526b3903b5ac494fe074453fa00cdb136
SHA17c1147ccc42086e8150f9bf40edd7ebe8b304953
SHA256f39e444ddf6e4e52aaa69e3b01247880177558f4d97123f4c2117ee622b456ef
SHA5126bb47c1ed625070faf4996e767480494d9803cd49fbb6d4713390251d95c37288fadee2004884c5f6c9006e2ffcf095d6ef269706235bc3a37dd0d1d224652c2
-
Filesize
2KB
MD56499637d0abba4d1de6dd16ae81a1c29
SHA11ab6237ed8ec8507553827d1fa3af789869ac172
SHA256c046bcf814b28d4735b8b44a2e0aec41cf345864a5827a3db38bb515a0d3f4d0
SHA5124b8da39f2cbeec103b41f88eafd766b99a53eb1e8c9a2fb837a1a1eeca65a5f831d149d56860eb02b60457dd7d9c2dd9631a8fb934640330948ac95da35b244c
-
Filesize
342B
MD5f45424383d631b7c386568e7f0e7e037
SHA13fa4b837abf74cf8cdbc7c21f99215ba764d607b
SHA2563159c0419015401e808da6cbd6c90140844dfafd153d85c7b2218affeed47f16
SHA51277751fb3c18b4768ca20e18e4b4d3fc26d40b938b123b6b7a751a728b833d4819c475f4ca6afd1160e8bcdc2fa69bea6be7d0f04d81da50bb6ba35df652a6307
-
Filesize
342B
MD55433649c49db913e58cf3e6b84bba66f
SHA11b68bb887389e874e04a634ddee0948a04f8bc26
SHA25671788dad7cfe0878864201f85f4da7fd8db9e93d6b9047d496bb1f88d16059bc
SHA5127c426a166da0d7aa9c2b4c17a8253f04d2155375c53a7580d808bb0c90a1abd548309a8c38dba4ca7f17537de8a30b5fbc6e4b3cc176348d8f952710145f12a2
-
Filesize
342B
MD59e01c1c7e79c00194a4ee23c085abbd0
SHA1ba633f1745a5d3606cbc977cf447bc1d38ff3e78
SHA25600a0c63b2ee71f43f0fd9dd4768fbc401cd34214cfc7a3b2ea031964bc7ba2db
SHA512e27190719db1c64b5ec38c89803f52e172d2cb1eca905153985bda60a291392248856c0e1023f1323f0ec193eb70c9a1edd0947c5de39c2f00dd5c940d5490cc
-
Filesize
342B
MD554291d8859d191c38ffe65504c23cb67
SHA1c70508ed87acfce5e3acdd71d69e16c7e5e6038f
SHA25682c30b37281946f92941126554b878814b7a90a8b246542f595fbcce6dea168a
SHA51231053aa358c19466aece615a467e54092e23b6d4a5bf48d68d5abab91b2fe9750925f7d0b8062cc4fe949b59252f641c4bc16759d00ead2421400918a2ed76c9
-
Filesize
342B
MD542a11c511f3ac794251f4775e2a35550
SHA1e5204d9485c50c3c8502e92685eaa2ec48529aeb
SHA256432a3a230f957cc5d1b75d931ec1f27e45641e467b96d8b1879e28db334d551c
SHA512bf804b39aaaa456cc1cd45d09a6e7928b44196a872dcf0fbae7e1d3b28d489c9f613cf8c6343914918bd0d803ff82fec9ef2649d79bd6d496e58424481971438
-
Filesize
342B
MD5531cb5216ac54fd07e40f03e4849e253
SHA138d5523ce4ac868699472d42c96c682c20a7e2d0
SHA256c2257224476f601f47534f70fcb804c97b8805fe347b6d00ef3a953982a050b5
SHA512f62b12647625c84c501e541190a708ceb3d9e92e75d35dbdace4a49197b13131d5f59bc7928a2d9750cdea64966a61382a9928125aa3f8f3e500dee105dc6574
-
Filesize
342B
MD5af9746ce7e0eecb197226e6f65f1a974
SHA13d19539e1ba702818edaf49a0b710f90257da92d
SHA256b87fa073bff6e0f704d0e2011c5df64637fde7b3ec84840ec871bbf07a5615af
SHA5120e0c868c4b1485e643f3ebcff57685a9e46d7ceeda87ff652c473caa76b2064d899d915bc5710db05daebd0841783607bae5dd0f25bba42de5a6ff627fdedb13
-
Filesize
342B
MD5cfd35bc238f9e8022f2dd1127ea008f3
SHA19e0195066595441f2c431ec29b4031cc4c1535e3
SHA2562751388f4a68c63d709ecf6d1fb3d1d01a27d1d32c7d8d2200e2e3f9f09afd44
SHA5122e994ae6f06f512673dc01c73f33e683bc88802955961a267b1faaa6154d32fba24f92112743b48e0279828c54ee060b759482f49b463cafdb25f65d18612818
-
Filesize
342B
MD5bb4897418ef5292256ee49019dc11d66
SHA1b708eef4c7d8a7cd9650d41b12b05d339a06f30f
SHA2563e69f11d356e85da8675e8fd4deff2fba236a4bf70fa6724062e4c5d395e6a49
SHA512c402a84bad60bc9173f6421b095653e3bb90af34ba024dc658e71e1cbbc23437025db2bba5cedd6cae2cce161d2ffca674b739b052cfdc7ed7ea03a2f0cd9e29
-
Filesize
342B
MD5e9dac34d0465fab0f5153fdac0c459e6
SHA1e7d04dff5d5cd2a8703849d2eb3ec70fb2abbb1e
SHA256a603aef27a4639a73ce89de88cbb6f5722668c03f15aef6b90b442d84270f7dd
SHA5120235d3cc577c99fb0e8ed367bb6d43b848030de9795193e6a9ae3afd1e0f86783657f1cd373d27b05738875d4e284ba6fcfe0dff2b44929ebf22821b72ecf6d2
-
Filesize
342B
MD5715c1155e2f9767e6bf38e2243c51b3c
SHA1e88880a801e13c80fc193924acb731773f6a35cd
SHA256206e8d11a5b3bc7dc5bf16a9ec49ad3b7d7de39dd4fd38a0f64a2da4c81ab06e
SHA5122526f0c052001f956e2f9d30c48c251624b34198e0e2eb333e8289511b160c432ac96c9f2871e583ca071cd9c5cab3dc4f81b3171831f0c21dafa6153f7dc715
-
Filesize
342B
MD5bb873c8bc6f770796e09d68d52f0c3e3
SHA11e6e2db4db79e48d1333a9c4fd0b1c2747d24af8
SHA256eba25e7cba6a7074e56ea2a14e6bcb4a04c96d9505ab79ad5520a66641075a3b
SHA512dbba337469e9874b37fe6f1971a21950e751b8924383ad010bfd96a434a44c91d30fd5bfb942aadd715a1080d5dd44cb62f7269a2ee36a495ad5e017cc314ecc
-
Filesize
342B
MD54a27a0f1f655931db243b0f2044b515a
SHA113dd2dc7ceef842efb9da061bc90a16b36037a73
SHA256934efa9c960a3f80c58953703df4c48f1f9cd73df69e08bede43fefec37d2e36
SHA51204f02c6e96012f53015e5cbe34b1b2a0a6d746ed9256eb0287e80fa8a3cb4a0c56866a5f2aa52d1466e1d8e8d729e605e68cf1bfbb84704919b665f06eedcc2a
-
Filesize
342B
MD57f5b3aa1c16891f12df6305d9dade3af
SHA1429f66bbc0708846484eff89efa5a55b613458ae
SHA256df207c165e58e27a4a48bafe23abeeaa6436e333529c888abe914d5e6ad6fde2
SHA5129170d09aa613be6755de01f7da0c71be78875ee6fb6a81451863dd0349f3ce3fd8d7ee07ecc33266d70fdcc220c6a48d43834823725078efcc1179d481a564ad
-
Filesize
342B
MD515c907219ddef43f04d5e9169cadc5af
SHA11884631e505d4329b46a86a56628cc8ad0f60bd7
SHA25657973393aed8d2912775cce5dce85af1a4f442a8f8ccb10e6611e9d17479f6f7
SHA512460dbd42bbe1b07130513b7825ca68e49f456e3070ac5812acc3b9da1977e57d541ee0da200bc1fe91056ae1f8ccfc15e6703b06d975e560cde29a4c05eefc11
-
Filesize
342B
MD5d8d08eb78f9e3fd369bda905c4c99906
SHA181730216d67d1a005c7f01646cfe9b38465fea77
SHA2562a551e3733cb332a1843ec317b6065865d778690ccbf7b0bf9dbaebca5fc992e
SHA5124574ac1a22731c6cfd56b3617e1399647014f83568e5b63ccb2c227df5d75de02270231ee6dec89bd4516392929048e49a418114109f7c46a2b98272eb5dcd6b
-
Filesize
342B
MD59855cc0ae60f802181cbdd729601e6bf
SHA1878bedee306d187dd424d38fb96e4ab90c191e08
SHA256e282d96a56172e9cf8f71cdf171a9641acf1b26d360716ed84be11db3f010ebb
SHA5128147453c550609d57ac9e7365c97ba080a04f297bea58edcbbada56cf5cefed28acfddf2fb8bf6d5d2334091d25b8b2081ca6a9931341ed43a16d0efb517863d
-
Filesize
342B
MD5ebc6e61bce0e7a26785cd97e21cc1aff
SHA1cfe985725e7c1c06fb9be5e617f10eb4081b6829
SHA25654a100487a8fbdfdfdfc0b2f8ffdf4a311bf02335b203bdb2d489ae341ac650b
SHA51241c209f729d8692a7ffb43bb65a89b64248ab58647504d449a0084bc48b440c2e0dde3bd847589f6b583527ae3443c77aa568b1147c65ff3daafa9f70618396a
-
Filesize
342B
MD58696e821b15347bb18ea86711fd3145d
SHA13defd068a4dc481cd78a3ce5863558ff26e06efe
SHA256459cd850486f382da3652061364fa6cd96d0a458a68c9020d1f497701e99c1d2
SHA512a2c5a726ef8cbc510ada3ece25e3170c49d72bc636cf954b25f2b1222efc427312f72e8f1f94fcdbe4cf49714c2ee069eb7db1f4ed58c15bfa435c6b8b4742f6
-
Filesize
342B
MD547bc5bde769046d1f101d31bbaa4b850
SHA1a6be9291dc9f6ae6c70b4c8c08add0a04b2bc533
SHA256b759f235cc56c2208b7146f786e950f41dc3cea28e3673ef9d7f612f10150009
SHA51293d1fad7da1cc58f3afd5205890ccd8f16627a900fd24be08d1bc31d58611c53874d8a3aaeaa8469bd8c342f96bec45e7159afe3e00d0c941d38c6251eaeac8d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
339KB
MD51449cdc2acb385e8326dfd0364e67d25
SHA127ec595e01e4c89fb17a895bced8b84871355df4
SHA2567007b16d76f879588fbbaef6ed77de0be778d38b09ace3740d50068937334dab
SHA512d660379a13c169ca0690a64cf5427d75ca71030e61bcc2795d6ddbd41d21028b453487c170db74303aa6c2c76d188272c8f6ad049ac4e579c6aaf738590d8c0b
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
12KB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
16KB
-
Filesize
2.9MB
-
Filesize
12KB
-
Filesize
2.9MB