d418ca84ca4bb7db72d2b00f8d6225a57909e02f712c7b0e2d9cefb2e18d0737

Resubmissions

13-07-2024 09:54

240713-lxbx6swdmm 10

13-07-2024 09:50

240713-lvbvdsyapd 10

13-07-2024 09:46

240713-lr1dksyajd 10

Analysis

max time kernel
1200s
max time network
1201s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe
Size

213KB
MD5

3271867f57a7ddd53d2f36210f79b241
SHA1

04ccf49f32406c6a0d61745bae090a9426a1500d
SHA256

15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f
SHA512

a0a0725b6023cab53363303db4aa0c6c1c1916a6b178b1f3a6301e779c67a2b1d68202a696ee328ffa9080f2f7236f581cbf8aadef4eadebb748ed6fcf35baa9
SSDEEP

3072:XBkGJ8YXmHDZLWlTSMu/9laSnsBOSrXo0hL5VNWrIV9Y5cYE3vqY:uGuYXeDZW4MuVgUsBOchL5LWrIV9ugq

Score

9^/10

defense_evasion execution impact persistence ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (111) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\discord = "C:\\Users\\Admin\\AppData\\Local\\discord.exe"	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\Desktop\desktop.ini	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe
File created	C:\Users\Admin\Downloads\desktop.ini	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe
File created	C:\Users\Admin\Documents\desktop.ini	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe
File created	C:\Users\Admin\Pictures\desktop.ini	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe
File created	C:\Users\Admin\Music\desktop.ini	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe
File created	C:\Users\Admin\Videos\desktop.ini	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1468	vssadmin.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\├æ:\ABREME.exe	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1616	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	2696	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe
Token: SeBackupPrivilege	900	vssvc.exe
Token: SeRestorePrivilege	900	vssvc.exe
Token: SeAuditPrivilege	900	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2244	WMIC.exe
Token: SeSecurityPrivilege	2244	WMIC.exe
Token: SeTakeOwnershipPrivilege	2244	WMIC.exe
Token: SeLoadDriverPrivilege	2244	WMIC.exe
Token: SeSystemProfilePrivilege	2244	WMIC.exe
Token: SeSystemtimePrivilege	2244	WMIC.exe
Token: SeProfSingleProcessPrivilege	2244	WMIC.exe
Token: SeIncBasePriorityPrivilege	2244	WMIC.exe
Token: SeCreatePagefilePrivilege	2244	WMIC.exe
Token: SeBackupPrivilege	2244	WMIC.exe
Token: SeRestorePrivilege	2244	WMIC.exe
Token: SeShutdownPrivilege	2244	WMIC.exe
Token: SeDebugPrivilege	2244	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2244	WMIC.exe
Token: SeRemoteShutdownPrivilege	2244	WMIC.exe
Token: SeUndockPrivilege	2244	WMIC.exe
Token: SeManageVolumePrivilege	2244	WMIC.exe
Token: 33	2244	WMIC.exe
Token: 34	2244	WMIC.exe
Token: 35	2244	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2244	WMIC.exe
Token: SeSecurityPrivilege	2244	WMIC.exe
Token: SeTakeOwnershipPrivilege	2244	WMIC.exe
Token: SeLoadDriverPrivilege	2244	WMIC.exe
Token: SeSystemProfilePrivilege	2244	WMIC.exe
Token: SeSystemtimePrivilege	2244	WMIC.exe
Token: SeProfSingleProcessPrivilege	2244	WMIC.exe
Token: SeIncBasePriorityPrivilege	2244	WMIC.exe
Token: SeCreatePagefilePrivilege	2244	WMIC.exe
Token: SeBackupPrivilege	2244	WMIC.exe
Token: SeRestorePrivilege	2244	WMIC.exe
Token: SeShutdownPrivilege	2244	WMIC.exe
Token: SeDebugPrivilege	2244	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2244	WMIC.exe
Token: SeRemoteShutdownPrivilege	2244	WMIC.exe
Token: SeUndockPrivilege	2244	WMIC.exe
Token: SeManageVolumePrivilege	2244	WMIC.exe
Token: 33	2244	WMIC.exe
Token: 34	2244	WMIC.exe
Token: 35	2244	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2696	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2696	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 1616	2696	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe	32
PID 2696 wrote to memory of 1616	2696	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe	32
PID 2696 wrote to memory of 1616	2696	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe	32
PID 2696 wrote to memory of 1616	2696	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe	32
PID 2696 wrote to memory of 1284	2696	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe	33
PID 2696 wrote to memory of 1284	2696	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe	33
PID 2696 wrote to memory of 1284	2696	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe	33
PID 2696 wrote to memory of 1284	2696	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe	33
PID 2696 wrote to memory of 2844	2696	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe	35
PID 2696 wrote to memory of 2844	2696	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe	35
PID 2696 wrote to memory of 2844	2696	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe	35
PID 2696 wrote to memory of 2844	2696	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe	35
PID 1284 wrote to memory of 1468	1284	cmd.exe	37
PID 1284 wrote to memory of 1468	1284	cmd.exe	37
PID 1284 wrote to memory of 1468	1284	cmd.exe	37
PID 1284 wrote to memory of 1468	1284	cmd.exe	37
PID 1284 wrote to memory of 2244	1284	cmd.exe	39
PID 1284 wrote to memory of 2244	1284	cmd.exe	39
PID 1284 wrote to memory of 2244	1284	cmd.exe	39
PID 1284 wrote to memory of 2244	1284	cmd.exe	39

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe
"C:\Users\Admin\AppData\Local\Temp\15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\README.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1616
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1468
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2244
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\usb_maker.bat" "
  2⤵
  - NTFS ADS
  PID:2844

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6fd06058d3ab87fdb082c9266c1dc5b6

SHA1
41442dcb955a71127f16ecb0331b93c619f39729

SHA256
f90ce9c07ad2f28b28eb1dd3b4968b90f72e380d635d92bb7055d066d510f586

SHA512
ca082effc1c47aa645506d75cd57f9be00fe0b6f54ef8edc1d6850625e716f98be6f40ca33456eed9536c541361bb353bb372155f151584cca08e1f1ed44829c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
721187ed1b4b903b92bfc28aa531cb78

SHA1
82fa4c71933a39327209ce684422ce27a5dc7779

SHA256
7592c785e23bbe341d6317a565deafd75a389d2e59fa65bfb7bf83af10c37d54

SHA512
b4b49b34713e539ae6d04a90c1e660ea83e25102bf2bb55d42f2f24e0f0277502da3270650a36377f1bf68c636ee6860a90921b76d3a741f16e321f99b885daa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c9b83c6160dea53d4694a3362f2d444b

SHA1
ce73e3b7846b58c5447d8bbf4bcee46aff0dd951

SHA256
3c77f4457ce5063b68f1aeed061c8be275622090d902135e5c813bc72dee2f66

SHA512
1c8c59df4d2451357005effb37afdae5d22eba1209dbf9e3988543aa346546c47392f48425e1605ddfee9d4b0b094b33449ab6ddd1c266969c333e2873ec0ad8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab931D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9330.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\usb_maker.bat

Filesize
3KB

MD5
c0c5ea4a87cf257e1bb8e00a12c07547

SHA1
a19b220f995c1fa20543923826dad36c3a93cb9d

SHA256
a621983b68c548c7474d8bebae8d21cf3c475cc5c88ae56a14e49c0dda1596b2

SHA512
f8f77fd675dc8e2fc5c617c92a091f3e84f915bfd272d193ef26e90747505c9153f53eedf2ba7879099f986895576c7dfef30a82a03612db5f1ad136685bf0ab

Download Submit
C:\Users\Admin\Documents\SendBlock.xlsx

Filesize
10KB

MD5
79d581e1308a18fce51777ee5c85f24f

SHA1
65af0aa3e5b45451dee0a7478dd06132e61366d4

SHA256
f1e8c151e2f598fb3950cc5132f903614349a722bd356db2650e2102f7f715b5

SHA512
3d20e14c925a3ee0d6b476d643d2f2cb99a2cb5777bb8bf732a165ef2724fa4dcf37b74bd1e5116a5065b296dc788a59057db4059ee588159335e1a4057dc754

Download Submit
C:\Users\Admin\Music\README.txt

Filesize
59B

MD5
09b2d4bb8bdb6e27426041856d3dd047

SHA1
403fc705e8db8e37d8a0f8356e21766df22aa7f7

SHA256
b411b13301ba7e00525cf9bc6e29e48a3d0d4c68be2a67807aa395b52cb78ae9

SHA512
75eea188e4586ce1a46ea8e7f24d7f3f30fcdd832e2af4d2ead6fe6cdfbeda31f7082b6aadcd4cfba059edce59f494e51163e0e02d26160d759dc31f6e37a080

Download Submit
memory/2696-1816-0x000000007418E000-0x000000007418F000-memory.dmp

Filesize
4KB

Download
memory/2696-2024-0x0000000074180000-0x000000007486E000-memory.dmp

Filesize
6.9MB

Download
memory/2696-0-0x000000007418E000-0x000000007418F000-memory.dmp

Filesize
4KB

Download
memory/2696-2-0x0000000074180000-0x000000007486E000-memory.dmp

Filesize
6.9MB

Download
memory/2696-1-0x0000000001300000-0x000000000133A000-memory.dmp

Filesize
232KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads