Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
10-06-2024 10:45
General
-
Target
VirusShare_1fca02c9b41ca8164dcbe5624a925036.exe
-
Size
309KB
-
MD5
1fca02c9b41ca8164dcbe5624a925036
-
SHA1
a65d2fdbea2f21772adae110ef03eb187bc0fdac
-
SHA256
90bd8c1f54522db5821ff3ed670531f50e88ec61ce1ab3b5f9c9477cebd79ff3
-
SHA512
423cbe37adf1f7f7ae610d0097368109a4ea767bd58cfd013f6afdbe54d34f430fa6c9287909b99d7177902f97f411e2e1b3c6c3eef8acd7c72a6630e377f2a8
-
SSDEEP
6144:KXWVWipoUM2rSBnr5XdsM9ZWYXOqJsVup/sO3z+WuLY:KiWimUxrUrZxmuOq6VupX40
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\restore_files_evpeg.txt
http://lk2gaflsgh.jgy658snfyfnvh.com/F5CEE7156A8C37B
http://dg62wor94m.sdsfg834mfuuw.com/F5CEE7156A8C37B
https://djdkduep62kz4nzx.onion.to/F5CEE7156A8C37B
http://djdkduep62kz4nzx.onion/F5CEE7156A8C37B
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\restore_files_evpeg.html
https://djdkduep62kz4nzx.onion.to/F5CEE7156A8C37B</a>
Signatures
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (431) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
-
Drops startup file 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies Internet Explorer settings 1 TTPs 36 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 32 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_1fca02c9b41ca8164dcbe5624a925036.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_1fca02c9b41ca8164dcbe5624a925036.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\vcwxqt.exeC:\Users\Admin\AppData\Roaming\vcwxqt.exe2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RESTORE_FILES.TXT3⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RESTORE_FILES.HTML3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Roaming\vcwxqt.exe >> NUL3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE >> NUL2⤵
- Deletes itself
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5094a6257b7495cb7e41e6717fde86e91
SHA1112d44352583f3402c46242c5d4b5126b8773f3f
SHA2561a8ba690393498e4196453d051e09188f86ffc3faef9f4fbaa212eda29aecf50
SHA5126eb039197c981ea971b87aa1ceeaf69e69e774945ec233af99d3f20e016295b112c613c2e34512a864b574e8b1eba7fa9b0319494a47ef8b98c3bb704ec3c7a7
-
Filesize
2KB
MD5b5f4e8d68fb7bc632220ccdc57cae90b
SHA16afc66d066cfb456a6373e13dd325031906456b4
SHA256f6b2cb1bd58540d11cf6b33c1ab05ac887408603fcf58ab70fca62e4ea2a6503
SHA512df3bf0e138ea7efb6fabe5682284bf3ae11553da3ce7e64672728490acf3547dc3c6c100d18d9c4d5e0632c4184f29589b453f5c0230bce48475bf235d526064
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
342B
MD57ab73067aa867e8d9d290fbfd0e805b3
SHA14458ed324b933e3d4b181c2448dd42486e903a39
SHA25612b072d3fb931dbc88e09bb2b271f7148f5e5ac55f213e908371bb4bdbdcbf34
SHA512e0a3298af3adf8cbd4fe1861ca10178e8879c4851227061a7c92855c5f35432c0e1981c1f6e02dfed694bc68bd0d6b73d32ea8ce6667979893b512a070310a3d
-
Filesize
342B
MD586c2ecf66514b212b66582264d458933
SHA1f9549f9f2ebf0e07eda9c136033e8e69ef2f852e
SHA256492c5859a5c76f38cad1b891bbfcbb53975e6aec022c9feb0861c6382bc5ae02
SHA5125115d03f5ffcc02b556581dfe44df44375212fb886c17c046304a099e481b43bbc5771b6b62ff2ac112c93cf770a27debaf03abcbd5b51262fb9b4685e0e82ac
-
Filesize
342B
MD595637348fc383b30b98fd6bd11be2738
SHA187edb61769dd16f64f0a6d579a8eb7a47f726af5
SHA25625c0f2fd9aada342a2aa069cdcb4afd81a5d7f78d88af3e2e1cdbb583f53c4e4
SHA512a04cf698127e219b6d035e96b03f14c35ecf0adf552a38dd6ed5957d3562669fddb272b32bf1d3a57e88318f0e1c5d185c05d103e09fb36ebbf10f19a1b01d29
-
Filesize
342B
MD5274a20a9cd82789f3fd778b33f8fca88
SHA12c5b7a8a0f0f75a8e4aa41b1520eacb2fe03ffd0
SHA256069be97a3b89ada52f249268d7d1bddfdc65bd4dbbfd5536fb9cd8e88a121fc7
SHA512f107bd9010f6419b7dbb29cf8dae71d689339b2d9dd05d44b95c2069deec76124bab9441f386cf8fea7ea9981aefaa374e9f9d80c78440209e40f52fb283561d
-
Filesize
342B
MD5e8c4682fe39df65c98ae812133b172bc
SHA1b7ce76a1d9ed9f7f020e0e2d8d37b4082219b0e0
SHA2569a25fa92ad79fe3edf69ff149b81646fcba01f52bcfe924456001be02bf420a7
SHA512b6763e51e452018f34dc24443c522486499bc13ad0e3132d979192bcc19fecc5afdcf507b7a5589b81ef99431b249cdb1fa68abbe85d4cfdea342305a4430503
-
Filesize
342B
MD5442a98003e0314f7c93851c0f4eefc2b
SHA14ad6665bfcbc03676525bed8ad3f7d4bcfd9d983
SHA2569f5f9faf5207d6a77625f4915ab7c6358023ba0c00003164dbe5af0225639c40
SHA5128bed73659e4b2d8a9971249bbac50953f59478c9b89f99fc19d42abb425c6ad475bb917a8130b9e7d61acc25d951b70f14ea08d81651bf79e7dbf747e95195f3
-
Filesize
342B
MD56201178792fd74880c01d805be97a6b9
SHA197f2139c63859d417c8865257b671b8d755e228a
SHA2565e7aa97a07cedcbb8a34cb1519f8feaa299bcfa44e35baf6a5f2638770b819b0
SHA512bde1f633d576e280cacb3e5919139e8f98964e84f8bb37bc62785630d67022363600ca5ba877179cab88862abb6aebd381d73232c6d719b68fde7a678795c7d7
-
Filesize
342B
MD5c177f6d15bb721311f441c2103317808
SHA18640bc47a7c97b2796d271d485af04a049aa780a
SHA25604c16fc8b63d2191d1a1781f3c75abf043c477632e705160c4582c14ba4e6dae
SHA51205e7f4f8f81fc19dbeb03d7dc970dcc8ce08af7668962210d11c5298cf96a3b36dbec0cb2c53ab81f0bf9b236e9722638bf30f1c2c80c6143757a3cc2f7fac43
-
Filesize
342B
MD505bb5fdc41b59411112b330c7904e7f3
SHA170fef95c69a94a5c24e03b47949cf7e21e32af17
SHA256bfcebda10d50c73ab3e0a6311471cddd6a5bca7e1c927d933a37540e2b5de97e
SHA51219c38f188da8ece04ee4c894060e6d45cd2fdb0181b1aad73ac0f5ed56c0ff73f2a5843b780f27f2c9eadd9bc6b850c07094d6e9359a64bb00469da769f0ba56
-
Filesize
342B
MD5f1b86eb433b56a0a163dc4226da0cec2
SHA1aaa705140fb1b9ed6eedf81bec7026b641ba8106
SHA256e586b7e97b1d7b273661aec87275d51b1449401820bec81075df9e93a3883949
SHA5121690917c4babc42307382591877dada24a2cf296f794803d895d109282285d18465074e662c4b64ed890eef28e899a6f8b0b0bc111315a48672b12c9416b5482
-
Filesize
342B
MD5bd8f99255fe1f95dd800918b9daabb1f
SHA1d6119881c97fe745c76376e643cb0362d8343dee
SHA256ecac30e91d23a64607f0cd2870259c836294bdaf8733823bb3ddf195e4c20e18
SHA5122e737d9bf9f643248314da52a8b8f7cd6b7f0257ae9b28c7f5a17a5c6b610ed007233f490f39ed06eee644c14ea5de5aa97527958c7fa61704e034923ff7bad0
-
Filesize
342B
MD5a4f574cba0711bb862d0516f47a74763
SHA16edee955fe600c16ccf7379701152621c691f052
SHA25606b6f8a181ad66d4d8be8767959b0f27e83d02be470a118a587b5e45cbb03fb6
SHA512ee5ef16aeef187de363bb7047579a7f562f2f7c94193fb76f908cd583c37ab621e3da387fcfbcc2bcf206e22261bf40fe0efed176c69117cf6b38858ea864f45
-
Filesize
342B
MD591f1eacf0af14b6d28e20e2509a461fd
SHA11063fe2dd39737614618803bf086f27bb7b6c635
SHA2563f8a93db86f9eecb8dd3d91627f834bd433cb28e90ddb650d02d9e96b638cfae
SHA512df6235f823ea93b06d9c926f37a83b7de624d7c72bf550da72fd36890f498aad4698a9babcb8ad96e057e0b3363ed01795df47f495582665925fbc410860d157
-
Filesize
342B
MD52f63f1fb0b5c4568312f8d6ae66029b8
SHA18b1df93979fafb35275165eb22e98af73dccba95
SHA256d750114c3f8db3aaa1842c10579ffbda93611c5b2638f07412cdfafd5328cb28
SHA512cbb870c5c783313806b85127742cc326b69cb38f16470ec17cbe170348f9fbbb8a02275b2600b99c6e1b2f5d4fc17014cbb42dc5b50dd7751d60224af39d7406
-
Filesize
342B
MD545b52e3d7384eb9e5eb26a145bb2f253
SHA178c35d1dbdd494943c354afe21af545e7dba9462
SHA2561e94adc5d15d4fd0478a2a0665993ddc61fdd965ebecb12c95ebfb4bf2495df2
SHA512119296e02c3d7a51069cc7288cd8c51a5aac14e959551aa9b4ba4d9747434fb07f020458f27bbf612e5a53993d5a702b41e1c4a3a0f0d22a510bbc9936714841
-
Filesize
342B
MD5ba61ffbb2ee132541e77e94a9e7da7ae
SHA115886bb23e9b88da8f59f15b96bf3171c7e7199a
SHA25660bddcf9ea91b165b745654e4688d4bd25e6a2ed8aec8c7c9299ddadd46ca747
SHA512883d057f64dd918405252aed804f375c4af44ae82f0587201d6a8c30753617f3c4f0b8b4e278a04c5bfdcc1b57c1254c40a9e0cac7a68f503901f1cb7c815d78
-
Filesize
342B
MD5e8ebfb508b7f903d4fbf6450a39cf319
SHA113bcd7df1196afd6a7ff8d0db47040d4c658e23f
SHA2567150967fa6134507690b47ecb400231378545cb5ebe22827ab478965468912ae
SHA512972be7316b1232ccee7ab3cc7b5120b39c4139c1466ef2220fa22247532b6e5a17dd8171929749f3883e256090d41a3316998a0ef4ebd576074552067706a255
-
Filesize
342B
MD53d0ffd9dd2b95ba9e3897bf2ac0f353e
SHA173fed79ca23171d64d590ef5ac6e01ec17be7b41
SHA2563fda8ffb9272dd2a2b0440ef7b8098d1a4b2c5222181769ea089c4bfbfffab79
SHA512825e1c4829c4ac45088c13a00d04a292e16946a9b6bb6c2ca0586b130037854fd70c8cd703786405d9e1a0d483fc66ce2b68150980f16d44de49e7e9c4395b33
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
309KB
MD51fca02c9b41ca8164dcbe5624a925036
SHA1a65d2fdbea2f21772adae110ef03eb187bc0fdac
SHA25690bd8c1f54522db5821ff3ed670531f50e88ec61ce1ab3b5f9c9477cebd79ff3
SHA512423cbe37adf1f7f7ae610d0097368109a4ea767bd58cfd013f6afdbe54d34f430fa6c9287909b99d7177902f97f411e2e1b3c6c3eef8acd7c72a6630e377f2a8
-
Filesize
2.3MB
-
Filesize
12KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
16KB
-
Filesize
12KB