d418ca84ca4bb7db72d2b00f8d6225a57909e02f712c7b0e2d9cefb2e18d0737

Resubmissions

13-07-2024 09:54

240713-lxbx6swdmm 10

13-07-2024 09:50

240713-lvbvdsyapd 10

13-07-2024 09:46

240713-lr1dksyajd 10

Analysis

max time kernel
1715s
max time network
1148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13-07-2024 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe
Size

213KB
MD5

3271867f57a7ddd53d2f36210f79b241
SHA1

04ccf49f32406c6a0d61745bae090a9426a1500d
SHA256

15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f
SHA512

a0a0725b6023cab53363303db4aa0c6c1c1916a6b178b1f3a6301e779c67a2b1d68202a696ee328ffa9080f2f7236f581cbf8aadef4eadebb748ed6fcf35baa9
SSDEEP

3072:XBkGJ8YXmHDZLWlTSMu/9laSnsBOSrXo0hL5VNWrIV9Y5cYE3vqY:uGuYXeDZW4MuVgUsBOchL5LWrIV9ugq

Score

9^/10

defense_evasion execution impact persistence ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (143) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\discord = "C:\\Users\\Admin\\AppData\\Local\\discord.exe"	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe

Drops desktop.ini file(s) 10 IoCs

Processes:

15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe

description	ioc	process
File created	C:\Users\Admin\Documents\desktop.ini	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe
File created	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe
File created	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe
File created	C:\Users\Admin\OneDrive\desktop.ini	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe
File created	C:\Users\Admin\Downloads\desktop.ini	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe
File created	C:\Users\Admin\Pictures\desktop.ini	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe
File created	C:\Users\Admin\Music\desktop.ini	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe
File created	C:\Users\Admin\Videos\desktop.ini	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe
File created	C:\Users\Admin\3D Objects\desktop.ini	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe
File created	C:\Users\Admin\Desktop\desktop.ini	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3836 4364 WerFault.exe 15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe

pid	pid_target	process	target process
3836	4364	WerFault.exe	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe

Modifies registry class 1 IoCs

Processes:

15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\Local Settings	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe

NTFS ADS 1 IoCs

Processes:

cmd.exe

description ioc process

File created C:\Users\Admin\AppData\Local\Temp\├æ:\ABREME.exe cmd.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

4116 NOTEPAD.EXE

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp\├æ:\ABREME.exe	cmd.exe

pid	process
4116	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exeWMIC.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	4364	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe
Token: SeIncreaseQuotaPrivilege	392	WMIC.exe
Token: SeSecurityPrivilege	392	WMIC.exe
Token: SeTakeOwnershipPrivilege	392	WMIC.exe
Token: SeLoadDriverPrivilege	392	WMIC.exe
Token: SeSystemProfilePrivilege	392	WMIC.exe
Token: SeSystemtimePrivilege	392	WMIC.exe
Token: SeProfSingleProcessPrivilege	392	WMIC.exe
Token: SeIncBasePriorityPrivilege	392	WMIC.exe
Token: SeCreatePagefilePrivilege	392	WMIC.exe
Token: SeBackupPrivilege	392	WMIC.exe
Token: SeRestorePrivilege	392	WMIC.exe
Token: SeShutdownPrivilege	392	WMIC.exe
Token: SeDebugPrivilege	392	WMIC.exe
Token: SeSystemEnvironmentPrivilege	392	WMIC.exe
Token: SeRemoteShutdownPrivilege	392	WMIC.exe
Token: SeUndockPrivilege	392	WMIC.exe
Token: SeManageVolumePrivilege	392	WMIC.exe
Token: 33	392	WMIC.exe
Token: 34	392	WMIC.exe
Token: 35	392	WMIC.exe
Token: 36	392	WMIC.exe
Token: SeIncreaseQuotaPrivilege	392	WMIC.exe
Token: SeSecurityPrivilege	392	WMIC.exe
Token: SeTakeOwnershipPrivilege	392	WMIC.exe
Token: SeLoadDriverPrivilege	392	WMIC.exe
Token: SeSystemProfilePrivilege	392	WMIC.exe
Token: SeSystemtimePrivilege	392	WMIC.exe
Token: SeProfSingleProcessPrivilege	392	WMIC.exe
Token: SeIncBasePriorityPrivilege	392	WMIC.exe
Token: SeCreatePagefilePrivilege	392	WMIC.exe
Token: SeBackupPrivilege	392	WMIC.exe
Token: SeRestorePrivilege	392	WMIC.exe
Token: SeShutdownPrivilege	392	WMIC.exe
Token: SeDebugPrivilege	392	WMIC.exe
Token: SeSystemEnvironmentPrivilege	392	WMIC.exe
Token: SeRemoteShutdownPrivilege	392	WMIC.exe
Token: SeUndockPrivilege	392	WMIC.exe
Token: SeManageVolumePrivilege	392	WMIC.exe
Token: 33	392	WMIC.exe
Token: 34	392	WMIC.exe
Token: 35	392	WMIC.exe
Token: 36	392	WMIC.exe
Token: SeBackupPrivilege	640	vssvc.exe
Token: SeRestorePrivilege	640	vssvc.exe
Token: SeAuditPrivilege	640	vssvc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe

pid process

4364 15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe

pid process

4364 15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe

pid	process
4364	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe

pid	process
4364	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.execmd.exe

description	pid	process	target process
PID 4364 wrote to memory of 4116	4364	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe	NOTEPAD.EXE
PID 4364 wrote to memory of 4116	4364	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe	NOTEPAD.EXE
PID 4364 wrote to memory of 4116	4364	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe	NOTEPAD.EXE
PID 4364 wrote to memory of 260	4364	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe	cmd.exe
PID 4364 wrote to memory of 260	4364	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe	cmd.exe
PID 4364 wrote to memory of 260	4364	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe	cmd.exe
PID 4364 wrote to memory of 1508	4364	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe	cmd.exe
PID 4364 wrote to memory of 1508	4364	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe	cmd.exe
PID 4364 wrote to memory of 1508	4364	15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe	cmd.exe
PID 260 wrote to memory of 392	260	cmd.exe	WMIC.exe
PID 260 wrote to memory of 392	260	cmd.exe	WMIC.exe
PID 260 wrote to memory of 392	260	cmd.exe	WMIC.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe
"C:\Users\Admin\AppData\Local\Temp\15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\README.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4116
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:260
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\usb_maker.bat" "
  2⤵
  - NTFS ADS
  PID:1508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 2324
  2⤵
  - Program crash
  PID:3836

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4364 -ip 4364
1⤵
PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\usb_maker.bat

Filesize
3KB

MD5
c0c5ea4a87cf257e1bb8e00a12c07547

SHA1
a19b220f995c1fa20543923826dad36c3a93cb9d

SHA256
a621983b68c548c7474d8bebae8d21cf3c475cc5c88ae56a14e49c0dda1596b2

SHA512
f8f77fd675dc8e2fc5c617c92a091f3e84f915bfd272d193ef26e90747505c9153f53eedf2ba7879099f986895576c7dfef30a82a03612db5f1ad136685bf0ab

Download Submit
C:\Users\Admin\Pictures\Camera Roll\README.txt

Filesize
59B

MD5
09b2d4bb8bdb6e27426041856d3dd047

SHA1
403fc705e8db8e37d8a0f8356e21766df22aa7f7

SHA256
b411b13301ba7e00525cf9bc6e29e48a3d0d4c68be2a67807aa395b52cb78ae9

SHA512
75eea188e4586ce1a46ea8e7f24d7f3f30fcdd832e2af4d2ead6fe6cdfbeda31f7082b6aadcd4cfba059edce59f494e51163e0e02d26160d759dc31f6e37a080

Download Submit
memory/4364-0-0x0000000074EFE000-0x0000000074EFF000-memory.dmp

Filesize
4KB

Download
memory/4364-1-0x00000000000F0000-0x000000000012A000-memory.dmp

Filesize
232KB

Download
memory/4364-2-0x0000000005000000-0x00000000055A4000-memory.dmp

Filesize
5.6MB

Download
memory/4364-3-0x0000000004B10000-0x0000000004BA2000-memory.dmp

Filesize
584KB

Download
memory/4364-4-0x0000000074EF0000-0x00000000756A0000-memory.dmp

Filesize
7.7MB

Download
memory/4364-5-0x0000000004F60000-0x0000000004F6A000-memory.dmp

Filesize
40KB

Download
memory/4364-322-0x0000000074EFE000-0x0000000074EFF000-memory.dmp

Filesize
4KB

Download
memory/4364-323-0x0000000074EF0000-0x00000000756A0000-memory.dmp

Filesize
7.7MB

Download
memory/4364-324-0x0000000074EF0000-0x00000000756A0000-memory.dmp

Filesize
7.7MB

Download