Analysis
-
max time kernel
359s -
max time network
361s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-11-2024 03:25
General
-
Target
encryptor_raas_9cffd965b4a0e662f6b98fd47d3b6ec9bc1b8581.exe
-
Size
111KB
-
MD5
2ce82b2c3e43a6090685bf7e3ec36d0f
-
SHA1
112a99938d60abd821e345538b0b1446cd9113a5
-
SHA256
d4410c277e4120169a546d613d06b6f1ca1c09ea94494baeb0af796bfaefeefa
-
SHA512
9f0fc8a81da4977d683e4051169b5ca0f3fcd592a6946da8a4da962c2519c1fd0044baa0c950332334d9bb6e56a43aceb174bd18166cd183921d5d4213c01ece
-
SSDEEP
1536:Nynce2jUA5AaPcHbh7g9WKBvwAYbwdlR3zkWOSgiC81rZ8R9YgAic2i:RrjxwHbhgNwAp/R7pgi7rWv
Malware Config
Signatures
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops file in Drivers directory 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 64 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 25 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\encryptor_raas_9cffd965b4a0e662f6b98fd47d3b6ec9bc1b8581.exe"C:\Users\Admin\AppData\Local\Temp\encryptor_raas_9cffd965b4a0e662f6b98fd47d3b6ec9bc1b8581.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /Quiet /All2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /Quiet /All3⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://kqd2eml2kjib53oe.onion.link/vict?cust=9cffd965b4a0e662f6b98fd47d3b6ec9bc1b8581&guid=bf99bef1-312f-4726-8597-70228ef05e992⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2668 CREDAT:275457 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
821B
MD5e05a483e9a949fcda524cb8b4ab8ba36
SHA1398774b20f4b26c51088d552dcceeaea55302be0
SHA256f07bdef5a164e4484c0a3d9315bf94792503543877863ea0e57e955f9d9dae9d
SHA512d52bde031c3f7926afe042c85596246789b5817fde835f6309c5b5874477b109cd4d976209c28d469285a2b99b6ae5a0e4a3d6dc7ef2eee69e7dd1a579458368
-
Filesize
342B
MD5722d8f52a4f387cffee97f9b2160b05b
SHA1f189a57167e9e526f1619b71f7cb77a730b3ee2c
SHA2560cf31829390341fb0704d4a74c47c7ed47c3ed9e32045198644339670121481f
SHA5129ffeeb065e46817e3571c7a3f1828f4a3decae320bf68ce7d8a81888c2709244a6092571edcda6e160dca57566f953adf757280914c63fb56f0f203287522f9e
-
Filesize
342B
MD56fc1ae52fbbb2c8c363f8d98ef668647
SHA1650cfe49244ef95b44c6ae698d229a263e339dd5
SHA256ee471558df686d0a06ea8c7be012d16232d138e7ca02943c7b4b0c86ad94b61f
SHA5123a020d17b21e182a121ad141768b4961df096824da860749ed908a005e8d0e88f3b308bf0cf45b521cf846a263d45553b539d20d144b0b0d88eab834841e2edd
-
Filesize
342B
MD5a9bb4e1022c6fab16712f6fa74b50cca
SHA1161f9f2f8f3c02ab0ded0578e753c3cff697a501
SHA256ceca9d7d481cbd7120f5f950d94e93a2c62f584b86fdaf0b30fdd5266b1e49b1
SHA512b4c34097773507ef2c1748dc30bc34fd4f88b2ab5cd5eabef035f30efad20425ec5e4a1f6c79ac1a9d84c8a7f0e978e214c96a5064d4291a2b618a4076043092
-
Filesize
342B
MD5f69932549e545781bd413734ad00274a
SHA1cd118e066b5e670543775521c8eded8bd4492ee8
SHA256ba21c33595f78922828ddb7af0dd05a201641a78b8d6a8e9e1bd4f6dc8c741b0
SHA512a3e0b7f8899374a018ae6a3b770d70c1f360dd31342bb1fc9208e1845fd47eca55666e16a0472d91935afca2b050fa5ffaa25832319681e0c364087a3a56fbc5
-
Filesize
342B
MD5d7ff920e2974c03510e1c981e82e6a44
SHA127385d20adf2648d5a25d450cca5f25e956ab51e
SHA256f24d861298a887b29221de776b2fc8528e8fcbfa05615619035d8df861c29bd9
SHA5122f7b4eac34143035cca48ade0eded400d2d652f9f7514eadae7aacda2fb48d5ff278fe3d5991b8053d71040e25c9a188d3181825e31edf6faa5e972c375e6d36
-
Filesize
342B
MD55db9f6e33202891d538aa1a6f13319a2
SHA18d76049503f9e665f0c2fc261af1cd0b1d74386d
SHA256e1ff9df5fdc2cc5bfffc19c567a4a213adb8c7380cbb3b329c9434ea06c012d8
SHA5122c395a21039af442672f4cb797506f9ac3799aafca8d159c961fcd08f6987eb7993553e4a288fa282cd1df5ce3109576cd101fc8185c1cc9d665cb3c27dbaa80
-
Filesize
342B
MD5470f737a652430a6b499b4aa1a2bcd5b
SHA1fd85578f0c3b7bab81f28c462287fdccba1d7c48
SHA256db273bf642c98eb0f549bc7921db0a1a0ce465328c6a86166f022d55c3dfab51
SHA512b50948ab52e084f3e45286700d396cc45d86f27e026c4ad93de75d864bd98d9ff60ac4d1b3210dec2d9f3ccfb79be38cf2954aba41bdc90d732881a4ca604233
-
Filesize
342B
MD5d6263f9671e5146a1225d0fcb6d0c116
SHA13ca9f2d3a715f88ee2012595ae4b2a7ce20d6017
SHA25691ff2a1ad88644c39c095c8bbbb590926bb3ba61ccf3b09b77a5ab4af8a99d6d
SHA512bcc2457f2af69911ff22727779ca3d02e1995d57be6b648f1e527c56e59bb983628a827548345263da94588f863372d3eb785445f2f80ab6564e66757b78676e
-
Filesize
342B
MD52bfe5ef9cb9b115683ed54e7b697be95
SHA141b3a4ac5e2ff6547d672d910c002286182372ac
SHA256ed9e20a48dad20c11b5eb4d9d7f9e9e92dabddb7e188862632eb9b71de1cdd9e
SHA512da483262952c4e9d35127403c789d7b85bf1ae86647e8d13d60d35e6949b69fef75f64671cab1e5a33f1d26390660326917371429d5bfaf217cccbbffd6375f7
-
Filesize
342B
MD577d1b6ab9dce7d443094cc749fee6f97
SHA1e5f1880a8f466c195d196ffcba9d00011f1b60e7
SHA256d8dff5350b9e67b3e52da6304d6fe554ebf6bc64a3d2c25e2bceb1160b2d8bed
SHA512d63411252f9352bab679923a3b2011db31ce5986e7493f171ed0a4d9df9d650c440558d988fe51dd1e2aa45e147f063cc4099659ec7620749cccd5ffdb3ebe64
-
Filesize
342B
MD53e32e99ae25948d82cdcd10ab15569df
SHA17b96e8efc1a454df23d043ec20845e2cff8abadc
SHA2564533ef6c0cc26448652639ab8ad49f4b4498f99ae4eeba454d164a5374aa074f
SHA512d5a246fb1e1eea70bac98c01ce69a2027281a1808e07899612697f08f3d5473133dad065fb6d1cf0f78d7e8347167bef5c0fc0754b7b9355b988b1a7411815b1
-
Filesize
342B
MD592bf9d0b6bca10cf752525ef93d8d87c
SHA100aacb366be444ee497f0a9210eeed94451f5c63
SHA2569fa877b733ba1a902d4506a3c24e41cab643e52a3f6092376326ced353b084c2
SHA51227251121954342b9ef57c72c3f15f555a24261948fbed343e168d7e0a7af3c3c51ffb1510b782c4634daf13353daa2e44df1e97ad2f83e894d5704db1666f50a
-
Filesize
342B
MD52ca4f35a4712ac405bafe29808643639
SHA1550515683e94a438bb6ea20250f0e16ad863634d
SHA256c474fb59c5839b0cdb4b68bfded7be5593c8b99f7aca6590b719d58d61077b98
SHA512040c1227e59607ee6c840f9e2e72b55414175b20adf5b3224a52241fd4c75e573cf5c8d713ecfff58ea97edef4f2a4399a923e3a3c7d0199e109e1b4d654b773
-
Filesize
342B
MD556f883c112e675626203815b82c6218a
SHA1433764258ae1f57bc19029c6b790f7316b19901f
SHA256a012619a1675a072145ad30714990a2b60910e4a2a6aedfc1240ac4f1dbb8490
SHA5121952b191e5eff3246d7761ac91f5c00d1ab97243629b3e7c558508a7cd0d0ea9b9f74fc95b08ce5a308b3d0c0e964762ce899e2b58e8463e4dbb7cfc43e18a8f
-
Filesize
342B
MD53ac274f84763e4dfc8b703a4eb92f441
SHA107f62a694c54e8b58db4b1c2821b20894867ed13
SHA2565a73d962e4af6e847b0502c5e1d64f7e22e44daa9f5becbe8512e3a56ed6ac6a
SHA5124c5b8260a2c1ba0a200137f88f7305ef65d22cf3c8094d1191484deb6562f702a498942e2487446d0a8d298afc76515638e019420d66e2479990e9b0ba4c6a0b
-
Filesize
342B
MD506ef914198d488c0bcbabc0fa4e583a1
SHA1e4356386f1cd0ad51d63d33ef542ab3d0649183f
SHA256386ba1cd756f1ea15e922eafe942ce8f7a7ac97029e5383b52f6c7443a30be18
SHA512a020c2efefb1ba69dc83011dc21792dbbd8d34b64bb71ed2eae8b3e3506823b82223594d9ae1ab54ef6527671257a0df65206892cca0cf77d0d38ce73727e809
-
Filesize
342B
MD5ab6d5d0bf6ca4de7dc7a682658c85235
SHA19e9eb41b09fd7d94812329bccbc2f04f48335d56
SHA2565e2f0983036eb515f7d746c73e72c076f6172adfcf9966f88f9a22c77d93f045
SHA5124845f055cf76f801f9fc6d5eb09367b039779b0038745b9308ebf929b318d8816b8b23093857ae1b311af104a07b511ddefa5f6e5e2a8a8652ee384b0f3b3628
-
Filesize
342B
MD51d052f68eb2ab3ca932377e0e72252ca
SHA15cdb94ac70b777270b56babfd5614e419d701904
SHA2565ad6018e97eda29eaa6c4299ace648baa1b1084039dc5a44a5acde2de781145f
SHA512b01b49389601d5e3094d5b9d40d7d2753e9d9bf2fd18f548c66d86dbdb0223a2ce5d7e4f6159a88ba1cd89de4ce1e42ceb2a9c2db23dcd7341360f6298c84536
-
Filesize
342B
MD516c5e5ab90e4981c78b4aa148e4fa770
SHA1813fd4d48d7a18003f822fd4b623ae9d6c7b9c67
SHA256e396507ae838844433c0ef57a962df27ecedd3730695830013784acf689422d0
SHA5128aacc92db3118d4963d7a6859cda7ffd8a3ad7fc754e0c6619171cf365927c4f3b9db8a2ecf1d774a44cc8bf37fc7319fa602f44225b73b82a94b5db6af28fa5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB