Overview

overview

9

Static

static

3

a11218990e...c2.exe

windows7-x64

9

a11218990e...c2.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    38s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21/09/2024, 20:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    a11218990ec35fda067e6a8abc7d5aff29069d4628a56c1dd16f1e1df0687fc2.exe

  • Size

    997KB

  • MD5

    a5f09807ed92c8de93cca6486bff2f6c

  • SHA1

    0648f4d42c1b325cb41224927fb68ede9bad27a7

  • SHA256

    a11218990ec35fda067e6a8abc7d5aff29069d4628a56c1dd16f1e1df0687fc2

  • SHA512

    88ccd61f209b077a6d22b70f1b87765f2410408436f5d02b312056619fc7f03d6f262bf780e4c177a0731830ac2679f0802112e2ff89f6a70c990123fcaace09

  • SSDEEP

    12288:ohDex59iC4geF4487u2QWYgeWYg955/155/sqKQ5w22rLFZKF6bWe6akxh3CU+o/:UexN4geF4t7u2vKbbKF6ezh3MAQ

Score
9/10
defense_evasionevasionexecutionimpactransomware

Malware Config

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Drops startup file 2 IoCs
  • Drops desktop.ini file(s) 36 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Control Panel 3 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\a11218990ec35fda067e6a8abc7d5aff29069d4628a56c1dd16f1e1df0687fc2.exe
    "C:\Users\Admin\AppData\Local\Temp\a11218990ec35fda067e6a8abc7d5aff29069d4628a56c1dd16f1e1df0687fc2.exe"
    1⤵
    • Drops startup file
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2124
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin Delete Shadows /All /Quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2116
      • C:\Windows\system32\vssadmin.exe
        vssadmin Delete Shadows /All /Quiet
        3⤵
        • Interacts with shadow copies
        PID:2632
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3052
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} recoveryenabled No
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1108
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2152
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2680
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c wmic SHADOWCOPY /nointeractive
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2672
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic SHADOWCOPY /nointeractive
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2776
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A7AA3892-E0EC-457B-8FC5-DF358387B5BE}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2644
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A7AA3892-E0EC-457B-8FC5-DF358387B5BE}'" delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1992
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9CDB775E-A5D6-452B-A56A-BA620E0F7BFD}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2584
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9CDB775E-A5D6-452B-A56A-BA620E0F7BFD}'" delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2484
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9C1EF448-F6DA-47B6-A3EB-8C0870C4A941}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3048
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9C1EF448-F6DA-47B6-A3EB-8C0870C4A941}'" delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:432
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{494C03C6-B7B7-4DF1-8FA1-7D53E03DDA63}'" delete
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1856
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{494C03C6-B7B7-4DF1-8FA1-7D53E03DDA63}'" delete
        3⤵
          PID:2396
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F47BA72D-84E4-4D7E-BDAB-96318230ABB7}'" delete
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1604
        • C:\Windows\System32\wbem\WMIC.exe
          C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F47BA72D-84E4-4D7E-BDAB-96318230ABB7}'" delete
          3⤵
            PID:2888
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8235A2B2-EED6-4D84-9B47-CD02BB13E9C1}'" delete
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2392
          • C:\Windows\System32\wbem\WMIC.exe
            C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8235A2B2-EED6-4D84-9B47-CD02BB13E9C1}'" delete
            3⤵
              PID:2840
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{82E6CBF7-34AA-420A-ACFA-78E6B16AD8C2}'" delete
            2⤵
              PID:2836
              • C:\Windows\System32\wbem\WMIC.exe
                C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{82E6CBF7-34AA-420A-ACFA-78E6B16AD8C2}'" delete
                3⤵
                  PID:2864
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3CBCFC55-5255-4E65-8C94-0A792EA482BB}'" delete
                2⤵
                  PID:3020
                  • C:\Windows\System32\wbem\WMIC.exe
                    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3CBCFC55-5255-4E65-8C94-0A792EA482BB}'" delete
                    3⤵
                      PID:2960
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{45E828E2-3C55-49F9-825B-E01046E2A113}'" delete
                    2⤵
                      PID:2880
                      • C:\Windows\System32\wbem\WMIC.exe
                        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{45E828E2-3C55-49F9-825B-E01046E2A113}'" delete
                        3⤵
                          PID:1948
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{76239064-3F5F-4D70-92A4-670F55591560}'" delete
                        2⤵
                          PID:3024
                          • C:\Windows\System32\wbem\WMIC.exe
                            C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{76239064-3F5F-4D70-92A4-670F55591560}'" delete
                            3⤵
                              PID:2948
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1B4EF978-E9B0-41CF-AAE2-776E38E9EDCE}'" delete
                            2⤵
                              PID:704
                              • C:\Windows\System32\wbem\WMIC.exe
                                C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1B4EF978-E9B0-41CF-AAE2-776E38E9EDCE}'" delete
                                3⤵
                                  PID:2016
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C840305C-0D8E-4B8B-BC6D-4003520487F0}'" delete
                                2⤵
                                  PID:2336
                                  • C:\Windows\System32\wbem\WMIC.exe
                                    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C840305C-0D8E-4B8B-BC6D-4003520487F0}'" delete
                                    3⤵
                                      PID:968
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{048EB31A-BA93-40FE-9759-479CEEF5F9AF}'" delete
                                    2⤵
                                      PID:2156
                                      • C:\Windows\System32\wbem\WMIC.exe
                                        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{048EB31A-BA93-40FE-9759-479CEEF5F9AF}'" delete
                                        3⤵
                                          PID:1504
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{469E3BBE-F71A-45E0-BD8F-4D2DC75A9037}'" delete
                                        2⤵
                                          PID:552
                                          • C:\Windows\System32\wbem\WMIC.exe
                                            C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{469E3BBE-F71A-45E0-BD8F-4D2DC75A9037}'" delete
                                            3⤵
                                              PID:1132
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1E5E3EA6-3B5A-47E4-BB20-CAD4E6A45BA5}'" delete
                                            2⤵
                                              PID:2408
                                              • C:\Windows\System32\wbem\WMIC.exe
                                                C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1E5E3EA6-3B5A-47E4-BB20-CAD4E6A45BA5}'" delete
                                                3⤵
                                                  PID:2944
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6FD06C77-DFAC-4B42-A173-D0BD649CD10A}'" delete
                                                2⤵
                                                  PID:1344
                                                  • C:\Windows\System32\wbem\WMIC.exe
                                                    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6FD06C77-DFAC-4B42-A173-D0BD649CD10A}'" delete
                                                    3⤵
                                                      PID:1480
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{68983E3D-3AC8-4B20-8338-F372835B7DB4}'" delete
                                                    2⤵
                                                      PID:2424
                                                      • C:\Windows\System32\wbem\WMIC.exe
                                                        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{68983E3D-3AC8-4B20-8338-F372835B7DB4}'" delete
                                                        3⤵
                                                          PID:2276
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{FB19CD29-987A-4316-B729-A682ED3D39EE}'" delete
                                                        2⤵
                                                          PID:2608
                                                          • C:\Windows\System32\wbem\WMIC.exe
                                                            C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{FB19CD29-987A-4316-B729-A682ED3D39EE}'" delete
                                                            3⤵
                                                              PID:1320
                                                        • C:\Windows\system32\vssvc.exe
                                                          C:\Windows\system32\vssvc.exe
                                                          1⤵
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2532
                                                        • C:\Windows\system32\vssvc.exe
                                                          C:\Windows\system32\vssvc.exe
                                                          1⤵
                                                            PID:3464

                                                          Network

                                                                MITRE ATT&CK Enterprise v15

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • C:\PerfLogs\Admin\#Read-for-recovery.txt
                                                                  Filesize

                                                                  380B

                                                                  MD5

                                                                  790a0e3e5a7e9d6ff44e83e4256f77ae

                                                                  SHA1

                                                                  4164df6a9b0608c3d36a65e7787a6db7dfb830e0

                                                                  SHA256

                                                                  5d12b42bd46ded444ee915dc8ab0d6740a580f0f20d4b3f51c5e28067b21425c

                                                                  SHA512

                                                                  0f4fa54d7ec9a64bd266c52973dbc2b212a7be202bb27e851f36d2c590c90a2d4484ccc246ac408413b3ddb0c0faf8f9a1da70eeb006351437b590a01b5accae

                                                                  Download Submit