d418ca84ca4bb7db72d2b00f8d6225a57909e02f712c7b0e2d9cefb2e18d0737

Resubmissions

13/07/2024, 09:54

240713-lxbx6swdmm10

13/07/2024, 09:50

240713-lvbvdsyapd10

13/07/2024, 09:46

240713-lr1dksyajd10

Analysis

max time kernel
843s
max time network
846s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8.exe
Size 147KB
Sample240713-lvbvdsyapd
SHA256 06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8
MD5 ce4c09c4b836c31993e902adf115a54a
SHA1 5fe984d96c4361a996c898e93dd72538614ca0c6
SHA512 02226e2abb6616525a2431ce6f4d6c81d54d2c06f7cf4f5cb8af740b14e03df657e8fa22e71d8b83ab7e1cdb9b943868f7d3d687482b499d85b2ca7974f0140d
SSDEEP 3072:ribQR54LZPhG1tqIFMH4zGrEV9SzjS3vqY:riI6PhGqI+YqrEV9S2q
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

defense_evasion execution impact persistence ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\discord = "C:\\Users\\Admin\\AppData\\Local\\discord.exe"	06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2244	vssadmin.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\├æ:\example.exe	cmd.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	2752	06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8.exe
Token: SeBackupPrivilege	2056	vssvc.exe
Token: SeRestorePrivilege	2056	vssvc.exe
Token: SeAuditPrivilege	2056	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2192	WMIC.exe
Token: SeSecurityPrivilege	2192	WMIC.exe
Token: SeTakeOwnershipPrivilege	2192	WMIC.exe
Token: SeLoadDriverPrivilege	2192	WMIC.exe
Token: SeSystemProfilePrivilege	2192	WMIC.exe
Token: SeSystemtimePrivilege	2192	WMIC.exe
Token: SeProfSingleProcessPrivilege	2192	WMIC.exe
Token: SeIncBasePriorityPrivilege	2192	WMIC.exe
Token: SeCreatePagefilePrivilege	2192	WMIC.exe
Token: SeBackupPrivilege	2192	WMIC.exe
Token: SeRestorePrivilege	2192	WMIC.exe
Token: SeShutdownPrivilege	2192	WMIC.exe
Token: SeDebugPrivilege	2192	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2192	WMIC.exe
Token: SeRemoteShutdownPrivilege	2192	WMIC.exe
Token: SeUndockPrivilege	2192	WMIC.exe
Token: SeManageVolumePrivilege	2192	WMIC.exe
Token: 33	2192	WMIC.exe
Token: 34	2192	WMIC.exe
Token: 35	2192	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2192	WMIC.exe
Token: SeSecurityPrivilege	2192	WMIC.exe
Token: SeTakeOwnershipPrivilege	2192	WMIC.exe
Token: SeLoadDriverPrivilege	2192	WMIC.exe
Token: SeSystemProfilePrivilege	2192	WMIC.exe
Token: SeSystemtimePrivilege	2192	WMIC.exe
Token: SeProfSingleProcessPrivilege	2192	WMIC.exe
Token: SeIncBasePriorityPrivilege	2192	WMIC.exe
Token: SeCreatePagefilePrivilege	2192	WMIC.exe
Token: SeBackupPrivilege	2192	WMIC.exe
Token: SeRestorePrivilege	2192	WMIC.exe
Token: SeShutdownPrivilege	2192	WMIC.exe
Token: SeDebugPrivilege	2192	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2192	WMIC.exe
Token: SeRemoteShutdownPrivilege	2192	WMIC.exe
Token: SeUndockPrivilege	2192	WMIC.exe
Token: SeManageVolumePrivilege	2192	WMIC.exe
Token: 33	2192	WMIC.exe
Token: 34	2192	WMIC.exe
Token: 35	2192	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2752	06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2752	06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 988	2752	06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8.exe	31
PID 2752 wrote to memory of 988	2752	06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8.exe	31
PID 2752 wrote to memory of 988	2752	06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8.exe	31
PID 2752 wrote to memory of 988	2752	06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8.exe	31
PID 2752 wrote to memory of 2180	2752	06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8.exe	32
PID 2752 wrote to memory of 2180	2752	06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8.exe	32
PID 2752 wrote to memory of 2180	2752	06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8.exe	32
PID 2752 wrote to memory of 2180	2752	06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8.exe	32
PID 2752 wrote to memory of 2380	2752	06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8.exe	34
PID 2752 wrote to memory of 2380	2752	06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8.exe	34
PID 2752 wrote to memory of 2380	2752	06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8.exe	34
PID 2752 wrote to memory of 2380	2752	06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8.exe	34
PID 2180 wrote to memory of 2244	2180	cmd.exe	36
PID 2180 wrote to memory of 2244	2180	cmd.exe	36
PID 2180 wrote to memory of 2244	2180	cmd.exe	36
PID 2180 wrote to memory of 2244	2180	cmd.exe	36
PID 2180 wrote to memory of 2192	2180	cmd.exe	38
PID 2180 wrote to memory of 2192	2180	cmd.exe	38
PID 2180 wrote to memory of 2192	2180	cmd.exe	38
PID 2180 wrote to memory of 2192	2180	cmd.exe	38

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8.exe
"C:\Users\Admin\AppData\Local\Temp\06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\keygroup777 README.txt
  2⤵
  PID:988
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2244
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2192
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\usb_maker.bat" "
  2⤵
  - NTFS ADS
  PID:2380

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

usb_maker.bat

Path C:\Users\Admin\AppData\Roaming\usb_maker.bat
Size 3KB
SHA256 47e154fab9289766bf9ae5b1f64a008fe190c20be53367b80304931ed3625457
MD5 9f433c0ce2d406c7f788b6316792850f
SHA1 2f03173d978aaec53d1f24df6609c11c7ed06238
SHA512 f14eb5ad5517eeb96601955493b8518ca3767fa9de9efdc1c5dab9e4b962fcffd89cbd32857bbc8acfb956283c07cdda8fd813a59203901ab74fb79d70aaaba4
MD5 SHA1 SHA512

Submit Download

TW91bnRJbXBvcnQueGxzeA==.keygroup777tg

Path C:\Users\Admin\Desktop\TW91bnRJbXBvcnQueGxzeA==.keygroup777tg
Size 14KB
SHA256 33e4bb9a378e66cee95fe211de82df3d824621630eaf33d608b27c622d1ec60e
MD5 efbf6195007ca888f8b04def40036a22
SHA1 23a05b9eae4282f49e00a2ce269570a207ce901b
SHA512 6a7b0fc3124995a31cddc1441e3ad87e6574432424ae9aae70ff28e8dffd8cd9870a31879274d760efcc723e3dedd7a1081f514142f7e56d145a64a75eec95ef
SSDEEP 384:MAJ6dkngllM+sysCjGxsWdg/OGhcTgqIn2BW/vvS:MAJ6ddqyazLlrivS
MD5 SHA1 SHA512 SSDEEP

Submit Download

keygroup777 README.txt

Path C:\Users\Admin\Music\keygroup777 README.txt
Size 641B
SHA256 a823039134a4d60baedcb5b3155095ab7c345d5d7cbfd2a840eb480df73de0b4
MD5 5f0364fc719551207d7e48f8376b9f60
SHA1 3e117ef757b6d8e15a647113070e364e4ec08828
SHA512 63df60876c74104096ad74dbfc3188088566d3e809856e9e041cf77ad5d4cbc80e8c7649f08a88638ebafdc24c763eb3398ef4dc2f02cefb61d8ed8ec1a5642f
MD5 SHA1 SHA512

Submit Download

memory/2752-0-0x000000007427E000-0x000000007427F000-memory.dmp

Download

memory/2752-1-0x00000000013D0000-0x00000000013FA000-memory.dmp

Download

memory/2752-2-0x0000000074270000-0x000000007495E000-memory.dmp

Download

memory/2752-182-0x0000000074270000-0x000000007495E000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads