471f3fb1a953fab38be3081eb835574694bc72b94f239edc400d1ce3d7a8ecb0

Analysis

max time kernel
299s
max time network
303s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 03:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe
Size

276KB
MD5

0c997c93bf7aac43e8bc22a9ea2fd9f8
SHA1

1c1e46e49c769c48104ee40506c67f738c6978f9
SHA256

89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6
SHA512

da27770d969800978e3a21a4ff9d887f1cfca8ee33c81cbbd9c61aa5640e1f6535a6189b45f9c498d8e75628714226ff91658ff53855332036124459b34ebffa
SSDEEP

6144:1nsJCTa8fC8OrAk2o90sBDuSeJ5zOSP+N4s7:1nWCTa8fC8W/0sBWJ5zvp

Score

9^/10

defense_evasion discovery evasion execution impact persistence ransomware trojan

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Executes dropped EXE 1 IoCs

Processes:

89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe

pid process

1752 89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe

pid	process
1752	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iwinavok = "C:\\Windows\\emiwemym.exe"	explorer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe

description	pid	process	target process
PID 2496 set thread context of 1752	2496	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe
PID 1752 set thread context of 2684	1752	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe	explorer.exe

Drops file in Windows directory 2 IoCs

Processes:

explorer.exe

description ioc process

File created C:\Windows\emiwemym.exe explorer.exe
File opened for modification C:\Windows\emiwemym.exe explorer.exe

description	ioc	process
File created	C:\Windows\emiwemym.exe	explorer.exe
File opened for modification	C:\Windows\emiwemym.exe	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exeexplorer.exevssadmin.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe

Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exe

pid process

2716 vssadmin.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 1708 vssvc.exe
Token: SeRestorePrivilege 1708 vssvc.exe
Token: SeAuditPrivilege 1708 vssvc.exe

pid	process
2716	vssadmin.exe

description	pid	process
Token: SeBackupPrivilege	1708	vssvc.exe
Token: SeRestorePrivilege	1708	vssvc.exe
Token: SeAuditPrivilege	1708	vssvc.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exeexplorer.exe

description	pid	process	target process
PID 2496 wrote to memory of 1752	2496	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe
PID 2496 wrote to memory of 1752	2496	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe
PID 2496 wrote to memory of 1752	2496	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe
PID 2496 wrote to memory of 1752	2496	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe
PID 2496 wrote to memory of 1752	2496	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe
PID 2496 wrote to memory of 1752	2496	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe
PID 2496 wrote to memory of 1752	2496	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe
PID 2496 wrote to memory of 1752	2496	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe
PID 2496 wrote to memory of 1752	2496	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe
PID 2496 wrote to memory of 1752	2496	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe
PID 2496 wrote to memory of 1752	2496	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe
PID 1752 wrote to memory of 2684	1752	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe	explorer.exe
PID 1752 wrote to memory of 2684	1752	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe	explorer.exe
PID 1752 wrote to memory of 2684	1752	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe	explorer.exe
PID 1752 wrote to memory of 2684	1752	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe	explorer.exe
PID 1752 wrote to memory of 2684	1752	89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe	explorer.exe
PID 2684 wrote to memory of 2716	2684	explorer.exe	vssadmin.exe
PID 2684 wrote to memory of 2716	2684	explorer.exe	vssadmin.exe
PID 2684 wrote to memory of 2716	2684	explorer.exe	vssadmin.exe
PID 2684 wrote to memory of 2716	2684	explorer.exe	vssadmin.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe
"C:\Users\Admin\AppData\Local\Temp\89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Users\Admin\AppData\Roaming\Microsoft\89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\system32\explorer.exe"
    3⤵
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin.exe Delete Shadows /All /Quiet
      4⤵
      System Location Discovery: System Language Discovery
      Interacts with shadow copies
      PID:2716

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\uqijyqujoladetot\01000000

Filesize
4KB

MD5
5d797dd0dcc717c514380f040cbc7edc

SHA1
8992024eb3c362ab44dde1007f44ae969908a318

SHA256
c9de27fd76b85cf3a149726fe7a644163edb53ff58ab675aee07caa9c5c3c4c0

SHA512
cc556026e85908786a0b68cc1d286350d13f0768cfcb3d0f008d6d81418fb499008d9dafe1379d012c7b48004c6b98d76cbd5c44d336317218d6448eee8916bd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\89fb6d7ff29b0c349c19df2e81028a62a2758c33f2c72b87dc11af4f22d3c6f6.exe

Filesize
4KB

MD5
e1190859ab4f21e58d1873afc1b3cff2

SHA1
50d4f9f444dba70b9918c4b812b5d9a098e0f867

SHA256
9b6f8344738cd1b954066a8099333dfa46c360700d8113312e8f1f6f22afcb73

SHA512
f3924e6b6002e9122c9465d23ff5a574268800078e9fe6011e0d62dca6113ffaf786fa46338a02288d8059e09ef0e79ac96d004dacabcb708291cf4376294a38

Download Submit
memory/1752-24-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1752-11-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1752-10-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1752-12-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1752-22-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1752-18-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1752-29-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1752-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1752-15-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2496-0-0x000007FEF5E1E000-0x000007FEF5E1F000-memory.dmp

Filesize
4KB

Download
memory/2496-2-0x000007FEF5B60000-0x000007FEF64FD000-memory.dmp

Filesize
9.6MB

Download
memory/2496-3-0x000007FEF5B60000-0x000007FEF64FD000-memory.dmp

Filesize
9.6MB

Download
memory/2496-4-0x0000000000D90000-0x0000000000DD0000-memory.dmp

Filesize
256KB

Download
memory/2496-30-0x000007FEF5B60000-0x000007FEF64FD000-memory.dmp

Filesize
9.6MB

Download
memory/2496-1-0x0000000000470000-0x0000000000478000-memory.dmp

Filesize
32KB

Download
memory/2684-33-0x0000000000080000-0x00000000000BC000-memory.dmp

Filesize
240KB

Download
memory/2684-35-0x0000000000080000-0x00000000000BC000-memory.dmp

Filesize
240KB

Download
memory/2684-37-0x0000000000080000-0x00000000000BC000-memory.dmp

Filesize
240KB

Download
memory/2684-42-0x0000000000080000-0x00000000000BC000-memory.dmp

Filesize
240KB

Download
memory/2684-44-0x0000000000080000-0x00000000000BC000-memory.dmp

Filesize
240KB

Download
memory/2684-45-0x0000000000080000-0x00000000000BC000-memory.dmp

Filesize
240KB

Download