crypvault | 17b4d01d32c64a62e36496829da323fe308437048ca87143de7365fabd4194fd

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 03:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
Size

182KB
MD5

1105f1e5cd13fc30fde877432e27457d
SHA1

108f03f9c98c63506dd8b9f6581f37ae5c18de23
SHA256

dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d
SHA512

49e9e4b02f432b9cc8f36913ce275f1d13672be627119c183713b5d6fb9fe27fd2cea67421560a463aaa16db35feb15df7c45258e2d102b5f70edb02865d9373
SSDEEP

3072:nO2W3zwMGWxLNjglP4cdkYsxSehTr76bJnhL:O2izwWlFuPP2xSehX6Fx

Score

10^/10

crypvault pony collection credential_access defense_evasion discovery execution impact persistence ransomware rat spyware stealer

Malware Config

Extracted

Family

pony

http://hollandfintech.net/api/gate.php

Signatures

CrypVault
Ransomware family which makes encrypted files look like they have been quarantined by AV.
ransomware crypvault
Crypvault family
crypvault
Pony family
pony
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

vssadmin.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2508 696 vssadmin.exe
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Deletes itself 1 IoCs

Processes:

explorer.exe

pid process

2628 explorer.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	696	vssadmin.exe

pid	process
2628	explorer.exe

Drops startup file 3 IoCs

Processes:

svchost.exesvchost.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta	svchost.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	svchost.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

tasklist.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\IE4Data = "C:\\Windows\\SysWOW64\\IE4Data\\IE4Data.lnk"	tasklist.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\IE4Data = "C:\\Windows\\SysWOW64\\IE4Data\\IE4Data.lnk"	explorer.exe

Drops file in System32 directory 24 IoCs

Processes:

explorer.exe

description	ioc	process
File created	C:\Windows\SysWOW64\IE4Data\adsldp.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE4Data\api-ms-win-core-libraryloader-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE4Data\IE4Data.scr	explorer.exe
File opened for modification	C:\Windows\SysWOW64\IE4Data\IE4Data.lnk	explorer.exe
File created	C:\Windows\SysWOW64\IE4Data\adsmsext.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE4Data\api-ms-win-core-fibers-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE4Data\api-ms-win-core-processthreads-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE4Data\api-ms-win-core-datetime-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE4Data\api-ms-win-core-interlocked-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE4Data\api-ms-win-core-localregistry-l1-1-0.dll	explorer.exe
File opened for modification	C:\Windows\SysWOW64\IE4Data	explorer.exe
File created	C:\Windows\SysWOW64\IE4Data\ActionCenter.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE4Data\advapi32.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE4Data\aecache.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE4Data\api-ms-win-core-console-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE4Data\IE4Data.lnk	explorer.exe
File created	C:\Windows\SysWOW64\IE4Data\api-ms-win-core-handle-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE4Data\api-ms-win-core-misc-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE4Data\api-ms-win-core-string-l1-1-0.dll	explorer.exe
File opened for modification	C:\Windows\SysWOW64\IE4Data\IE4Data.scr	explorer.exe
File opened for modification	C:\Windows\SysWOW64\IE4Data\ActionCenter.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE4Data\amxread.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE4Data\api-ms-win-core-file-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\IE4Data\api-ms-win-core-file-l1-2-0.dll	explorer.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs
discovery

Process Discovery
T1057

Processes:

tasklist.exe

pid process

2940 tasklist.exe

pid	process
2940	tasklist.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe

description	pid	process	target process
PID 2412 set thread context of 2040	2412	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2388 336 WerFault.exe svchost.exe

pid	pid_target	process	target process
2388	336	WerFault.exe	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exeexplorer.exewmic.exemshta.exeexplorer.exemshta.exeexplorer.exedffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exetasklist.exeexplorer.exesvchost.exeexplorer.exesvchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exe

pid process

2508 vssadmin.exe

pid	process
2508	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

mshta.exemshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exedffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe

pid	process
2412	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
2040	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe

Suspicious behavior: MapViewOfSection 8 IoCs

Processes:

dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exeexplorer.exetasklist.exeexplorer.exeexplorer.exe

pid	process
2040	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
2628	explorer.exe
2940	tasklist.exe
2268	explorer.exe
2940	tasklist.exe
2940	tasklist.exe
2488	explorer.exe
2940	tasklist.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wmic.exesvchost.exevssvc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2812	wmic.exe
Token: SeSecurityPrivilege	2812	wmic.exe
Token: SeTakeOwnershipPrivilege	2812	wmic.exe
Token: SeLoadDriverPrivilege	2812	wmic.exe
Token: SeSystemProfilePrivilege	2812	wmic.exe
Token: SeSystemtimePrivilege	2812	wmic.exe
Token: SeProfSingleProcessPrivilege	2812	wmic.exe
Token: SeIncBasePriorityPrivilege	2812	wmic.exe
Token: SeCreatePagefilePrivilege	2812	wmic.exe
Token: SeBackupPrivilege	2812	wmic.exe
Token: SeRestorePrivilege	2812	wmic.exe
Token: SeShutdownPrivilege	2812	wmic.exe
Token: SeDebugPrivilege	2812	wmic.exe
Token: SeSystemEnvironmentPrivilege	2812	wmic.exe
Token: SeRemoteShutdownPrivilege	2812	wmic.exe
Token: SeUndockPrivilege	2812	wmic.exe
Token: SeManageVolumePrivilege	2812	wmic.exe
Token: 33	2812	wmic.exe
Token: 34	2812	wmic.exe
Token: 35	2812	wmic.exe
Token: SeIncreaseQuotaPrivilege	2812	wmic.exe
Token: SeSecurityPrivilege	2812	wmic.exe
Token: SeTakeOwnershipPrivilege	2812	wmic.exe
Token: SeLoadDriverPrivilege	2812	wmic.exe
Token: SeSystemProfilePrivilege	2812	wmic.exe
Token: SeSystemtimePrivilege	2812	wmic.exe
Token: SeProfSingleProcessPrivilege	2812	wmic.exe
Token: SeIncBasePriorityPrivilege	2812	wmic.exe
Token: SeCreatePagefilePrivilege	2812	wmic.exe
Token: SeBackupPrivilege	2812	wmic.exe
Token: SeRestorePrivilege	2812	wmic.exe
Token: SeShutdownPrivilege	2812	wmic.exe
Token: SeDebugPrivilege	2812	wmic.exe
Token: SeSystemEnvironmentPrivilege	2812	wmic.exe
Token: SeRemoteShutdownPrivilege	2812	wmic.exe
Token: SeUndockPrivilege	2812	wmic.exe
Token: SeManageVolumePrivilege	2812	wmic.exe
Token: 33	2812	wmic.exe
Token: 34	2812	wmic.exe
Token: 35	2812	wmic.exe
Token: SeImpersonatePrivilege	2432	svchost.exe
Token: SeTcbPrivilege	2432	svchost.exe
Token: SeChangeNotifyPrivilege	2432	svchost.exe
Token: SeCreateTokenPrivilege	2432	svchost.exe
Token: SeBackupPrivilege	2432	svchost.exe
Token: SeRestorePrivilege	2432	svchost.exe
Token: SeIncreaseQuotaPrivilege	2432	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2432	svchost.exe
Token: SeBackupPrivilege	2052	vssvc.exe
Token: SeRestorePrivilege	2052	vssvc.exe
Token: SeAuditPrivilege	2052	vssvc.exe
Token: SeImpersonatePrivilege	2432	svchost.exe
Token: SeTcbPrivilege	2432	svchost.exe
Token: SeChangeNotifyPrivilege	2432	svchost.exe
Token: SeCreateTokenPrivilege	2432	svchost.exe
Token: SeBackupPrivilege	2432	svchost.exe
Token: SeRestorePrivilege	2432	svchost.exe
Token: SeIncreaseQuotaPrivilege	2432	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2432	svchost.exe
Token: SeImpersonatePrivilege	2432	svchost.exe
Token: SeTcbPrivilege	2432	svchost.exe
Token: SeChangeNotifyPrivilege	2432	svchost.exe
Token: SeCreateTokenPrivilege	2432	svchost.exe
Token: SeBackupPrivilege	2432	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe

pid	process
2412	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
2412	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe

Suspicious use of WriteProcessMemory 61 IoCs

Processes:

dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exedffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exeexplorer.exetasklist.exeexplorer.exesvchost.exeexplorer.exesvchost.exe

description	pid	process	target process
PID 2412 wrote to memory of 2040	2412	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2412 wrote to memory of 2040	2412	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2412 wrote to memory of 2040	2412	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2412 wrote to memory of 2040	2412	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2412 wrote to memory of 2040	2412	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2412 wrote to memory of 2040	2412	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2412 wrote to memory of 2040	2412	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2412 wrote to memory of 2040	2412	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2412 wrote to memory of 2040	2412	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2412 wrote to memory of 2040	2412	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2412 wrote to memory of 2040	2412	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2412 wrote to memory of 2040	2412	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2412 wrote to memory of 2040	2412	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2040 wrote to memory of 2628	2040	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	explorer.exe
PID 2040 wrote to memory of 2628	2040	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	explorer.exe
PID 2040 wrote to memory of 2628	2040	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	explorer.exe
PID 2040 wrote to memory of 2628	2040	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	explorer.exe
PID 2628 wrote to memory of 2940	2628	explorer.exe	tasklist.exe
PID 2628 wrote to memory of 2940	2628	explorer.exe	tasklist.exe
PID 2628 wrote to memory of 2940	2628	explorer.exe	tasklist.exe
PID 2628 wrote to memory of 2940	2628	explorer.exe	tasklist.exe
PID 2940 wrote to memory of 2268	2940	tasklist.exe	explorer.exe
PID 2940 wrote to memory of 2268	2940	tasklist.exe	explorer.exe
PID 2940 wrote to memory of 2268	2940	tasklist.exe	explorer.exe
PID 2940 wrote to memory of 2268	2940	tasklist.exe	explorer.exe
PID 2268 wrote to memory of 2432	2268	explorer.exe	svchost.exe
PID 2268 wrote to memory of 2432	2268	explorer.exe	svchost.exe
PID 2268 wrote to memory of 2432	2268	explorer.exe	svchost.exe
PID 2268 wrote to memory of 2432	2268	explorer.exe	svchost.exe
PID 2940 wrote to memory of 2892	2940	tasklist.exe	explorer.exe
PID 2940 wrote to memory of 2892	2940	tasklist.exe	explorer.exe
PID 2940 wrote to memory of 2892	2940	tasklist.exe	explorer.exe
PID 2940 wrote to memory of 2892	2940	tasklist.exe	explorer.exe
PID 2432 wrote to memory of 2812	2432	svchost.exe	wmic.exe
PID 2432 wrote to memory of 2812	2432	svchost.exe	wmic.exe
PID 2432 wrote to memory of 2812	2432	svchost.exe	wmic.exe
PID 2432 wrote to memory of 2812	2432	svchost.exe	wmic.exe
PID 2432 wrote to memory of 1620	2432	svchost.exe	mshta.exe
PID 2432 wrote to memory of 1620	2432	svchost.exe	mshta.exe
PID 2432 wrote to memory of 1620	2432	svchost.exe	mshta.exe
PID 2432 wrote to memory of 1620	2432	svchost.exe	mshta.exe
PID 2940 wrote to memory of 2488	2940	tasklist.exe	explorer.exe
PID 2940 wrote to memory of 2488	2940	tasklist.exe	explorer.exe
PID 2940 wrote to memory of 2488	2940	tasklist.exe	explorer.exe
PID 2940 wrote to memory of 2488	2940	tasklist.exe	explorer.exe
PID 2488 wrote to memory of 336	2488	explorer.exe	svchost.exe
PID 2488 wrote to memory of 336	2488	explorer.exe	svchost.exe
PID 2488 wrote to memory of 336	2488	explorer.exe	svchost.exe
PID 2488 wrote to memory of 336	2488	explorer.exe	svchost.exe
PID 2940 wrote to memory of 892	2940	tasklist.exe	explorer.exe
PID 2940 wrote to memory of 892	2940	tasklist.exe	explorer.exe
PID 2940 wrote to memory of 892	2940	tasklist.exe	explorer.exe
PID 2940 wrote to memory of 892	2940	tasklist.exe	explorer.exe
PID 336 wrote to memory of 1776	336	svchost.exe	mshta.exe
PID 336 wrote to memory of 1776	336	svchost.exe	mshta.exe
PID 336 wrote to memory of 1776	336	svchost.exe	mshta.exe
PID 336 wrote to memory of 1776	336	svchost.exe	mshta.exe
PID 336 wrote to memory of 2388	336	svchost.exe	WerFault.exe
PID 336 wrote to memory of 2388	336	svchost.exe	WerFault.exe
PID 336 wrote to memory of 2388	336	svchost.exe	WerFault.exe
PID 336 wrote to memory of 2388	336	svchost.exe	WerFault.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_win_path 1 IoCs

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	svchost.exe

C:\Users\Admin\AppData\Local\Temp\dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
"C:\Users\Admin\AppData\Local\Temp\dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Users\Admin\AppData\Local\Temp\dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
  C:\Users\Admin\AppData\Local\Temp\dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Deletes itself
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Windows\SysWOW64\tasklist.exe
      C:\Windows\SysWOW64\tasklist.exe
      4⤵
      Adds Run key to start application
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2940
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2268
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        6⤵
        Drops startup file
        Accesses Microsoft Outlook accounts
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        outlook_win_path
        
        PID:2432
        
        C:\Windows\SysWOW64\Wbem\wmic.exe
        
        wmic process call create "vssadmin.exe delete shadows /all /quiet"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2812
        
        C:\Windows\SysWOW64\mshta.exe
        
        mshta.exe C:\Users\Admin\Desktop\VAULT.hta
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:1620
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2892
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2488
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        6⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:336
        
        C:\Windows\SysWOW64\mshta.exe
        
        mshta.exe C:\Users\Admin\Desktop\VAULT.hta
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:1776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 336 -s 348
        7⤵
        Program crash
        
        PID:2388
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:892

C:\Windows\system32\vssadmin.exe
vssadmin.exe delete shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2508

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta

Filesize
4KB

MD5
ca834cc56015bce8e010e356c69dc9f5

SHA1
b55ea373d3f5d583c33803d80059db5ddccf7038

SHA256
1b5feb1b9bf79a857330fc891a65824953ad5d72ce38b4fb41755475775c65bd

SHA512
66c6370c538567286641e2ca3438d28572a78b4d2a15912f9d55cc65f9c7491d16e3f277c9f1385ee6773ef400e1a47e7abe5208aa4d7f75b8db5c816e6531a8

Download Submit
C:\VAULT.KEY

Filesize
1KB

MD5
a6a39c97364f8fc8b412f55a01c0083d

SHA1
a77d1e5da21e028c66af5f15bae308ebe7877d3e

SHA256
03cecda8a69893262e6f00d532167ded5732dec991bcd163ccaeadad62001348

SHA512
6faac60921acf43cfc3bcf4bbdc7d7d433e408ae70d1900c54983eda943440f1e485d68f6271d14c3a7e3af6d38bb8c9c02b7221fb564b8ac8f7ccdd7f63d353

Download Submit
C:\VAULT.KEY

Filesize
1KB

MD5
e8d1dc697660fc828d75a73612f680f0

SHA1
eb5f51e52296f942c1e1065cb15dc06db9307263

SHA256
d203fa95c8fbec5abb1e41d845bee0f252e3c95eb7897d490b0c36806f104142

SHA512
82a650f326fa34e7902e8777a8f61ce7bbe1f4892f0bc9b61a663e99e4c033677f1e18d5a111e9ee636208cbf2563815787a9a0d5eb7d5c2d771bb49d2b203e1

Download Submit
C:\VAULT.KEY

Filesize
1KB

MD5
0451a438766083ffa91517ade99ee562

SHA1
70d104395a196c0e3f2a8dee109839d68ebb339d

SHA256
68decb91fe284f1216b079810d2273acddd0d7754cb22689fa0aecfd7dae3aa1

SHA512
240ebc181528d16323ca3398d539256241e72394afb4febd6df9dd3a7745af04ee1258e626043e90d58a7a9f5dfa4366dbedb5f75ad4c924abd65a7106ce1e79

Download Submit
C:\VAULT.KEY

Filesize
1KB

MD5
ebd505de3b65505482f979dcf1979d9b

SHA1
393e308f0fc53e209c16703fc6aa9743a9cc2811

SHA256
d7bc912b4d63233f377b744ff6cd4885812dd6227fb17cbfe7a3e089ca4fc78f

SHA512
1c8555ba6adfe26bc06757df999c863d176d904cce089cb059aa56d96d8aa2ff92160c00c824c1dd6f6bc73574af56d92f7ea1888ef4ca1de8b57077057cec4c

Download Submit
C:\VAULT.KEY

Filesize
1KB

MD5
2ec277aabfc39d7905efd15f5f3b904c

SHA1
de03298a7b4caf942dab6b2f78b17d288a8b03e9

SHA256
df136bc3d46f2975b2d9de603c550408b70e061fc05e66b24b093d66dc857714

SHA512
3977018a6aa83a0781ad1c2f2e938633fe1ecad3018e4f466436f1bc32412700954d91a959809438f5a813b31bd6587cc52fb7a15b02d621db29b4910d8b2028

Download Submit
C:\Windows\SysWOW64\IE4Data\IE4Data.lnk

Filesize
1KB

MD5
0dff388654ad9cf541763256dc0789a8

SHA1
b2a9296bbea70c57db307c41bb6b678e77aa3d73

SHA256
2a7857336eb95d83107b80b29299284121f94f8664535b5dab7609464864ba68

SHA512
c43893934a1c2ca060438a6f7cf3708013a70e52cfebe436ad5abe0ea4dfa4d30caa0b3782b900741b4e0026fffb61899bf57c7d9dc22b097c3fb8e18fbc2fa9

Download Submit
C:\Windows\SysWOW64\IE4Data\IE4Data.scr

Filesize
182KB

MD5
1105f1e5cd13fc30fde877432e27457d

SHA1
108f03f9c98c63506dd8b9f6581f37ae5c18de23

SHA256
dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d

SHA512
49e9e4b02f432b9cc8f36913ce275f1d13672be627119c183713b5d6fb9fe27fd2cea67421560a463aaa16db35feb15df7c45258e2d102b5f70edb02865d9373

Download Submit
memory/336-178-0x0000000000C60000-0x0000000000C68000-memory.dmp

Filesize
32KB

Download
memory/336-179-0x00000000000F0000-0x000000000011E000-memory.dmp

Filesize
184KB

Download
memory/336-198-0x00000000000F0000-0x000000000011E000-memory.dmp

Filesize
184KB

Download
memory/336-199-0x0000000000C60000-0x0000000000C68000-memory.dmp

Filesize
32KB

Download
memory/892-187-0x0000000000980000-0x0000000000C01000-memory.dmp

Filesize
2.5MB

Download
memory/892-186-0x0000000000980000-0x0000000000C01000-memory.dmp

Filesize
2.5MB

Download
memory/2040-7-0x0000000000400000-0x00000000009E9000-memory.dmp

Filesize
5.9MB

Download
memory/2040-11-0x0000000000400000-0x00000000009E9000-memory.dmp

Filesize
5.9MB

Download
memory/2040-1-0x0000000000300000-0x0000000000400000-memory.dmp

Filesize
1024KB

Download
memory/2040-19-0x0000000000400000-0x000000000040F1F7-memory.dmp

Filesize
60KB

Download
memory/2040-18-0x0000000000400000-0x00000000009E9000-memory.dmp

Filesize
5.9MB

Download
memory/2040-14-0x0000000000400000-0x00000000009E9000-memory.dmp

Filesize
5.9MB

Download
memory/2040-5-0x0000000000400000-0x00000000009E9000-memory.dmp

Filesize
5.9MB

Download
memory/2040-17-0x0000000000400000-0x00000000009E9000-memory.dmp

Filesize
5.9MB

Download
memory/2040-3-0x0000000000400000-0x00000000009E9000-memory.dmp

Filesize
5.9MB

Download
memory/2040-9-0x0000000000400000-0x00000000009E9000-memory.dmp

Filesize
5.9MB

Download
memory/2040-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2040-13-0x0000000000400000-0x00000000009E9000-memory.dmp

Filesize
5.9MB

Download
memory/2268-55-0x00000000005A0000-0x0000000000821000-memory.dmp

Filesize
2.5MB

Download
memory/2268-54-0x00000000005A0000-0x0000000000821000-memory.dmp

Filesize
2.5MB

Download
memory/2412-0-0x0000000000310000-0x0000000000315000-memory.dmp

Filesize
20KB

Download
memory/2432-58-0x0000000000080000-0x00000000000AE000-memory.dmp

Filesize
184KB

Download
memory/2432-166-0x0000000000080000-0x00000000000AE000-memory.dmp

Filesize
184KB

Download
memory/2432-57-0x0000000000380000-0x0000000000388000-memory.dmp

Filesize
32KB

Download
memory/2432-150-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/2432-154-0x0000000000380000-0x0000000000388000-memory.dmp

Filesize
32KB

Download
memory/2488-175-0x0000000000980000-0x0000000000C01000-memory.dmp

Filesize
2.5MB

Download
memory/2488-177-0x0000000000980000-0x0000000000C01000-memory.dmp

Filesize
2.5MB

Download
memory/2628-23-0x00000000000F0000-0x0000000000371000-memory.dmp

Filesize
2.5MB

Download
memory/2628-22-0x00000000000F0000-0x0000000000371000-memory.dmp

Filesize
2.5MB

Download
memory/2628-29-0x00000000000F0000-0x0000000000371000-memory.dmp

Filesize
2.5MB

Download
memory/2892-91-0x00000000005A0000-0x0000000000821000-memory.dmp

Filesize
2.5MB

Download
memory/2892-90-0x00000000005A0000-0x0000000000821000-memory.dmp

Filesize
2.5MB

Download
memory/2940-153-0x0000000000420000-0x0000000000436000-memory.dmp

Filesize
88KB

Download
memory/2940-51-0x0000000000420000-0x0000000000436000-memory.dmp

Filesize
88KB

Download
memory/2940-52-0x0000000000420000-0x0000000000436000-memory.dmp

Filesize
88KB

Download
memory/2940-50-0x0000000000420000-0x0000000000436000-memory.dmp

Filesize
88KB

Download