crypvault | 17b4d01d32c64a62e36496829da323fe308437048ca87143de7365fabd4194fd

Analysis

max time kernel
362s
max time network
368s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 03:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
Size

182KB
MD5

1105f1e5cd13fc30fde877432e27457d
SHA1

108f03f9c98c63506dd8b9f6581f37ae5c18de23
SHA256

dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d
SHA512

49e9e4b02f432b9cc8f36913ce275f1d13672be627119c183713b5d6fb9fe27fd2cea67421560a463aaa16db35feb15df7c45258e2d102b5f70edb02865d9373
SSDEEP

3072:nO2W3zwMGWxLNjglP4cdkYsxSehTr76bJnhL:O2izwWlFuPP2xSehX6Fx

Score

10^/10

crypvault pony collection credential_access defense_evasion discovery execution impact persistence ransomware rat spyware stealer

Malware Config

Extracted

Family

pony

http://hollandfintech.net/api/gate.php

Signatures

CrypVault
Ransomware family which makes encrypted files look like they have been quarantined by AV.
ransomware crypvault
Crypvault family
crypvault
Pony family
pony
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

vssadmin.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1760 704 vssadmin.exe
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Deletes itself 1 IoCs

Processes:

explorer.exe

pid process

2796 explorer.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	704	vssadmin.exe

pid	process
2796	explorer.exe

Drops startup file 3 IoCs

Processes:

svchost.exesvchost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta	svchost.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	svchost.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exetasklist.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Fontcore = "C:\\Windows\\SysWOW64\\Fontcore\\Fontcore.lnk"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Fontcore = "C:\\Windows\\SysWOW64\\Fontcore\\Fontcore.lnk"	tasklist.exe

Drops file in System32 directory 43 IoCs

Processes:

explorer.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Fontcore\ActionCenterCPL.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\api-ms-win-crt-multibyte-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\bcryptprimitives.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\catsrv.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\AuxiliaryDisplayApi.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\Fontcore.cmd	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\ActionCenterCPL.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\activeds.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\api-ms-win-crt-conio-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\appmgr.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\appidapi.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\bitsprx6.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\advpack.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\api-ms-win-core-file-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\api-ms-win-crt-private-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\apilogen.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\api-ms-win-downlevel-version-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\api-ms-win-service-management-l2-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\adsldpc.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\api-ms-win-core-heap-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\api-ms-win-crt-heap-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\api-ms-win-downlevel-ole32-l1-1-0.dll	explorer.exe
File opened for modification	C:\Windows\SysWOW64\Fontcore	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\api-ms-win-core-processthreads-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\btpanui.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\BWUnpairElevated.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\cabview.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\Fontcore.lnk	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\api-ms-win-core-errorhandling-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\api-ms-win-core-interlocked-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\api-ms-win-core-localization-l1-2-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\avifil32.dll	explorer.exe
File opened for modification	C:\Windows\SysWOW64\Fontcore\Fontcore.lnk	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\api-ms-win-core-rtlsupport-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\api-ms-win-core-synch-l1-2-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\authui.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\bitsprx4.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\catsrvut.dll	explorer.exe
File opened for modification	C:\Windows\SysWOW64\Fontcore\Fontcore.cmd	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\api-ms-win-core-datetime-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\api-ms-win-core-namedpipe-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\api-ms-win-downlevel-normaliz-l1-1-0.dll	explorer.exe
File created	C:\Windows\SysWOW64\Fontcore\audiodev.dll	explorer.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs
discovery

Process Discovery
T1057

Processes:

tasklist.exe

pid process

2760 tasklist.exe

pid	process
2760	tasklist.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe

description	pid	process	target process
PID 2536 set thread context of 2772	2536	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2920 1748 WerFault.exe svchost.exe

pid	pid_target	process	target process
2920	1748	WerFault.exe	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

tasklist.exewmic.exeexplorer.exedffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exedffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exeexplorer.exeexplorer.exesvchost.exemshta.exesvchost.exesvchost.exeexplorer.exemshta.exeexplorer.exeexplorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exe

pid process

1760 vssadmin.exe

pid	process
1760	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

mshta.exemshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exedffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe

pid	process
2536	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
2772	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe

Suspicious behavior: MapViewOfSection 10 IoCs

Processes:

dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exeexplorer.exetasklist.exeexplorer.exeexplorer.exeexplorer.exe

pid	process
2772	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
2796	explorer.exe
2760	tasklist.exe
2760	tasklist.exe
2576	explorer.exe
1840	explorer.exe
2760	tasklist.exe
2760	tasklist.exe
2876	explorer.exe
2760	tasklist.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wmic.exesvchost.exevssvc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2396	wmic.exe
Token: SeSecurityPrivilege	2396	wmic.exe
Token: SeTakeOwnershipPrivilege	2396	wmic.exe
Token: SeLoadDriverPrivilege	2396	wmic.exe
Token: SeSystemProfilePrivilege	2396	wmic.exe
Token: SeSystemtimePrivilege	2396	wmic.exe
Token: SeProfSingleProcessPrivilege	2396	wmic.exe
Token: SeIncBasePriorityPrivilege	2396	wmic.exe
Token: SeCreatePagefilePrivilege	2396	wmic.exe
Token: SeBackupPrivilege	2396	wmic.exe
Token: SeRestorePrivilege	2396	wmic.exe
Token: SeShutdownPrivilege	2396	wmic.exe
Token: SeDebugPrivilege	2396	wmic.exe
Token: SeSystemEnvironmentPrivilege	2396	wmic.exe
Token: SeRemoteShutdownPrivilege	2396	wmic.exe
Token: SeUndockPrivilege	2396	wmic.exe
Token: SeManageVolumePrivilege	2396	wmic.exe
Token: 33	2396	wmic.exe
Token: 34	2396	wmic.exe
Token: 35	2396	wmic.exe
Token: SeIncreaseQuotaPrivilege	2396	wmic.exe
Token: SeSecurityPrivilege	2396	wmic.exe
Token: SeTakeOwnershipPrivilege	2396	wmic.exe
Token: SeLoadDriverPrivilege	2396	wmic.exe
Token: SeSystemProfilePrivilege	2396	wmic.exe
Token: SeSystemtimePrivilege	2396	wmic.exe
Token: SeProfSingleProcessPrivilege	2396	wmic.exe
Token: SeIncBasePriorityPrivilege	2396	wmic.exe
Token: SeCreatePagefilePrivilege	2396	wmic.exe
Token: SeBackupPrivilege	2396	wmic.exe
Token: SeRestorePrivilege	2396	wmic.exe
Token: SeShutdownPrivilege	2396	wmic.exe
Token: SeDebugPrivilege	2396	wmic.exe
Token: SeSystemEnvironmentPrivilege	2396	wmic.exe
Token: SeRemoteShutdownPrivilege	2396	wmic.exe
Token: SeUndockPrivilege	2396	wmic.exe
Token: SeManageVolumePrivilege	2396	wmic.exe
Token: 33	2396	wmic.exe
Token: 34	2396	wmic.exe
Token: 35	2396	wmic.exe
Token: SeImpersonatePrivilege	576	svchost.exe
Token: SeTcbPrivilege	576	svchost.exe
Token: SeChangeNotifyPrivilege	576	svchost.exe
Token: SeCreateTokenPrivilege	576	svchost.exe
Token: SeBackupPrivilege	576	svchost.exe
Token: SeRestorePrivilege	576	svchost.exe
Token: SeIncreaseQuotaPrivilege	576	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	576	svchost.exe
Token: SeBackupPrivilege	2476	vssvc.exe
Token: SeRestorePrivilege	2476	vssvc.exe
Token: SeAuditPrivilege	2476	vssvc.exe
Token: SeImpersonatePrivilege	576	svchost.exe
Token: SeTcbPrivilege	576	svchost.exe
Token: SeChangeNotifyPrivilege	576	svchost.exe
Token: SeCreateTokenPrivilege	576	svchost.exe
Token: SeBackupPrivilege	576	svchost.exe
Token: SeRestorePrivilege	576	svchost.exe
Token: SeIncreaseQuotaPrivilege	576	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	576	svchost.exe
Token: SeImpersonatePrivilege	576	svchost.exe
Token: SeTcbPrivilege	576	svchost.exe
Token: SeChangeNotifyPrivilege	576	svchost.exe
Token: SeCreateTokenPrivilege	576	svchost.exe
Token: SeBackupPrivilege	576	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe

pid	process
2536	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
2536	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exedffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exeexplorer.exetasklist.exeexplorer.exeexplorer.exesvchost.exeexplorer.exesvchost.exe

description	pid	process	target process
PID 2536 wrote to memory of 2772	2536	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2536 wrote to memory of 2772	2536	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2536 wrote to memory of 2772	2536	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2536 wrote to memory of 2772	2536	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2536 wrote to memory of 2772	2536	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2536 wrote to memory of 2772	2536	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2536 wrote to memory of 2772	2536	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2536 wrote to memory of 2772	2536	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2536 wrote to memory of 2772	2536	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2536 wrote to memory of 2772	2536	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2536 wrote to memory of 2772	2536	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2536 wrote to memory of 2772	2536	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2536 wrote to memory of 2772	2536	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
PID 2772 wrote to memory of 2796	2772	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	explorer.exe
PID 2772 wrote to memory of 2796	2772	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	explorer.exe
PID 2772 wrote to memory of 2796	2772	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	explorer.exe
PID 2772 wrote to memory of 2796	2772	dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe	explorer.exe
PID 2796 wrote to memory of 2760	2796	explorer.exe	tasklist.exe
PID 2796 wrote to memory of 2760	2796	explorer.exe	tasklist.exe
PID 2796 wrote to memory of 2760	2796	explorer.exe	tasklist.exe
PID 2796 wrote to memory of 2760	2796	explorer.exe	tasklist.exe
PID 2760 wrote to memory of 2576	2760	tasklist.exe	explorer.exe
PID 2760 wrote to memory of 2576	2760	tasklist.exe	explorer.exe
PID 2760 wrote to memory of 2576	2760	tasklist.exe	explorer.exe
PID 2760 wrote to memory of 2576	2760	tasklist.exe	explorer.exe
PID 2760 wrote to memory of 1840	2760	tasklist.exe	explorer.exe
PID 2760 wrote to memory of 1840	2760	tasklist.exe	explorer.exe
PID 2760 wrote to memory of 1840	2760	tasklist.exe	explorer.exe
PID 2760 wrote to memory of 1840	2760	tasklist.exe	explorer.exe
PID 2576 wrote to memory of 576	2576	explorer.exe	svchost.exe
PID 2576 wrote to memory of 576	2576	explorer.exe	svchost.exe
PID 2576 wrote to memory of 576	2576	explorer.exe	svchost.exe
PID 2576 wrote to memory of 576	2576	explorer.exe	svchost.exe
PID 1840 wrote to memory of 952	1840	explorer.exe	svchost.exe
PID 1840 wrote to memory of 952	1840	explorer.exe	svchost.exe
PID 1840 wrote to memory of 952	1840	explorer.exe	svchost.exe
PID 1840 wrote to memory of 952	1840	explorer.exe	svchost.exe
PID 2760 wrote to memory of 1672	2760	tasklist.exe	explorer.exe
PID 2760 wrote to memory of 1672	2760	tasklist.exe	explorer.exe
PID 2760 wrote to memory of 1672	2760	tasklist.exe	explorer.exe
PID 2760 wrote to memory of 1672	2760	tasklist.exe	explorer.exe
PID 576 wrote to memory of 2396	576	svchost.exe	wmic.exe
PID 576 wrote to memory of 2396	576	svchost.exe	wmic.exe
PID 576 wrote to memory of 2396	576	svchost.exe	wmic.exe
PID 576 wrote to memory of 2396	576	svchost.exe	wmic.exe
PID 576 wrote to memory of 2516	576	svchost.exe	mshta.exe
PID 576 wrote to memory of 2516	576	svchost.exe	mshta.exe
PID 576 wrote to memory of 2516	576	svchost.exe	mshta.exe
PID 576 wrote to memory of 2516	576	svchost.exe	mshta.exe
PID 2760 wrote to memory of 2876	2760	tasklist.exe	explorer.exe
PID 2760 wrote to memory of 2876	2760	tasklist.exe	explorer.exe
PID 2760 wrote to memory of 2876	2760	tasklist.exe	explorer.exe
PID 2760 wrote to memory of 2876	2760	tasklist.exe	explorer.exe
PID 2876 wrote to memory of 1748	2876	explorer.exe	svchost.exe
PID 2876 wrote to memory of 1748	2876	explorer.exe	svchost.exe
PID 2876 wrote to memory of 1748	2876	explorer.exe	svchost.exe
PID 2876 wrote to memory of 1748	2876	explorer.exe	svchost.exe
PID 2760 wrote to memory of 2792	2760	tasklist.exe	explorer.exe
PID 2760 wrote to memory of 2792	2760	tasklist.exe	explorer.exe
PID 2760 wrote to memory of 2792	2760	tasklist.exe	explorer.exe
PID 2760 wrote to memory of 2792	2760	tasklist.exe	explorer.exe
PID 1748 wrote to memory of 2884	1748	svchost.exe	mshta.exe
PID 1748 wrote to memory of 2884	1748	svchost.exe	mshta.exe
PID 1748 wrote to memory of 2884	1748	svchost.exe	mshta.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_win_path 1 IoCs

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	svchost.exe

C:\Users\Admin\AppData\Local\Temp\dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
"C:\Users\Admin\AppData\Local\Temp\dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Users\Admin\AppData\Local\Temp\dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
  C:\Users\Admin\AppData\Local\Temp\dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Deletes itself
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Windows\SysWOW64\tasklist.exe
      C:\Windows\SysWOW64\tasklist.exe
      4⤵
      Adds Run key to start application
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2760
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2576
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        6⤵
        Drops startup file
        Accesses Microsoft Outlook accounts
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        outlook_win_path
        
        PID:576
        
        C:\Windows\SysWOW64\Wbem\wmic.exe
        
        wmic process call create "vssadmin.exe delete shadows /all /quiet"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2396
        
        C:\Windows\SysWOW64\mshta.exe
        
        mshta.exe C:\Users\Admin\Desktop\VAULT.hta
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:2516
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1840
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:952
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1672
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:2876
      - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        6⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1748
        
        C:\Windows\SysWOW64\mshta.exe
        
        mshta.exe C:\Users\Admin\Desktop\VAULT.hta
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:2884
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 360
        7⤵
        Program crash
        
        PID:2920
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2792

C:\Windows\system32\vssadmin.exe
vssadmin.exe delete shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1760

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VAULT.hta

Filesize
4KB

MD5
ca834cc56015bce8e010e356c69dc9f5

SHA1
b55ea373d3f5d583c33803d80059db5ddccf7038

SHA256
1b5feb1b9bf79a857330fc891a65824953ad5d72ce38b4fb41755475775c65bd

SHA512
66c6370c538567286641e2ca3438d28572a78b4d2a15912f9d55cc65f9c7491d16e3f277c9f1385ee6773ef400e1a47e7abe5208aa4d7f75b8db5c816e6531a8

Download Submit
C:\VAULT.KEY

Filesize
1KB

MD5
b016dd85b94d4020c3b00c65e88da2e2

SHA1
5bd57cb6b76db8b9aa421d915c0fd08583e5e94f

SHA256
910274869f619ebe2d6146453d08b6861c7770a0316c961ea51a07dec83e2e89

SHA512
803d08df67fa3c67f81f586838a8389011896aebd12354fb4c0795f747bdcdb0876996939a7d31a5bc087d962efc48050784c58eaccedcdf09a612d0b17d209c

Download Submit
C:\VAULT.KEY

Filesize
1KB

MD5
0a76640b1de589bfa790d454b95a3827

SHA1
6285d00315382fe81a9270dd3ea345a18bfbccc9

SHA256
bfb33881f161969d0d7982e6596016ad7ee3db61746bbb227ca9de5be8508ae4

SHA512
97d95835bc2828111a7671849f741763e8e857cc2ef130c39295f8e78e796ad0c24ad5d0ce80341e039b79ff83782f48f02e45ef03707131a0224fac36829b67

Download Submit
C:\VAULT.KEY

Filesize
1KB

MD5
5dd572e3080fff1818b87382e6ead887

SHA1
dc758af74b6789700ec3fca49afe0397d5c53415

SHA256
3b1c1d9154a1e10e689e8119fe3444aab37c40d63d7dab4cd78c8b8198aa6270

SHA512
f5c96169fc54c283623e47da1ffc6b414b937f344022e46f68164ae4027be4ca857ff7585a88baea8ed534b3341f8b6ae829de4c3e4aa6e24de8f079ca6b5e43

Download Submit
C:\VAULT.KEY

Filesize
1KB

MD5
bc42e4fdf1cf03c333764adbabab2a0e

SHA1
71cf5a46e1a5cc86d4abfb7f0259930126e13b7f

SHA256
61ec94418f4f7e48c211652bea4766fa279c0af0acb2b1970be0e3c06bd28d09

SHA512
3eaaa7aa484078d6b5c03d7ab2325d69c074a0b5e650cb75445add0a5778f145d118a61c9fd2ae6d4288e2eee25b9314427b164ad9dc7d92bf81a11dbdbc93a1

Download Submit
C:\VAULT.KEY

Filesize
1KB

MD5
49449553a16c8632f7bee68abab535e5

SHA1
d1c7a97df0d9ad711304a60e0c302947ffdcf635

SHA256
2a254d1e455f463facc14f59fb0c1512e617304354bf7053c8e75db6581bb607

SHA512
3b012b8c93b57b34e702aee2d8002e0f5bc34d576cc409c57cd0244e72e7bb5e9013f8f6e0b793b318faed99020ff584af99661e0a00e1571aa40a4139fd94af

Download Submit
C:\VAULT.KEY

Filesize
1KB

MD5
0bf3c28b0982a4ed6fc9222e6cb4281a

SHA1
d54d86e52ecebfcdee786e2b43ae6c75911f1369

SHA256
cd15cd3d3fe5435949c1d5040d553729dcfd7ecf99e1afd8f30a24ce11e4ab35

SHA512
f8f5aecb66dea9225f5e98d59b5103158502879c517725bdf720203a1027bf2bfcb508aada5d3c960871346ef4fdfc3323353f513227d006db371bf18f76bfb5

Download Submit
C:\Windows\SysWOW64\Fontcore\Fontcore.cmd

Filesize
182KB

MD5
1105f1e5cd13fc30fde877432e27457d

SHA1
108f03f9c98c63506dd8b9f6581f37ae5c18de23

SHA256
dffde400ad3d2af2bbd61c58bed9dcf7e3e37cec6210c9841d8ed5dc9117343d

SHA512
49e9e4b02f432b9cc8f36913ce275f1d13672be627119c183713b5d6fb9fe27fd2cea67421560a463aaa16db35feb15df7c45258e2d102b5f70edb02865d9373

Download Submit
C:\Windows\SysWOW64\Fontcore\Fontcore.lnk

Filesize
1KB

MD5
af2d46d20855f6cea0a291a819778b20

SHA1
f022a7d64f820f269aaa31839d03b42d9930f9b6

SHA256
d1807a78e2b610bfa27cb194d80ef533504f162fe0e3b745bc5e6d5ba1889dc0

SHA512
35c531fd437f5fc8cfc1a8e3451e9187888acfe56b54fd11d3cfef49f5baee3784df8db6a343f9d3f57d517c4ae6c85dd78a8eac31d01e6b3b9ff9cc864a5aa4

Download Submit
memory/576-180-0x0000000000260000-0x0000000000272000-memory.dmp

Filesize
72KB

Download
memory/576-79-0x00000000000D0000-0x00000000000FE000-memory.dmp

Filesize
184KB

Download
memory/576-196-0x00000000000D0000-0x00000000000FE000-memory.dmp

Filesize
184KB

Download
memory/576-184-0x0000000000F30000-0x0000000000F38000-memory.dmp

Filesize
32KB

Download
memory/576-78-0x0000000000F30000-0x0000000000F38000-memory.dmp

Filesize
32KB

Download
memory/952-84-0x0000000000F30000-0x0000000000F38000-memory.dmp

Filesize
32KB

Download
memory/952-85-0x0000000000F30000-0x0000000000F38000-memory.dmp

Filesize
32KB

Download
memory/1672-87-0x0000000000CE0000-0x0000000000F61000-memory.dmp

Filesize
2.5MB

Download
memory/1672-88-0x0000000000CE0000-0x0000000000F61000-memory.dmp

Filesize
2.5MB

Download
memory/1748-228-0x0000000000D50000-0x0000000000D58000-memory.dmp

Filesize
32KB

Download
memory/1748-203-0x00000000001F0000-0x000000000021E000-memory.dmp

Filesize
184KB

Download
memory/1748-202-0x0000000000D50000-0x0000000000D58000-memory.dmp

Filesize
32KB

Download
memory/1840-82-0x0000000000CE0000-0x0000000000F61000-memory.dmp

Filesize
2.5MB

Download
memory/2536-0-0x00000000003C0000-0x00000000003C5000-memory.dmp

Filesize
20KB

Download
memory/2576-73-0x0000000000CE0000-0x0000000000F61000-memory.dmp

Filesize
2.5MB

Download
memory/2576-72-0x0000000000CE0000-0x0000000000F61000-memory.dmp

Filesize
2.5MB

Download
memory/2576-74-0x0000000000CE0000-0x0000000000F61000-memory.dmp

Filesize
2.5MB

Download
memory/2760-69-0x0000000000610000-0x0000000000626000-memory.dmp

Filesize
88KB

Download
memory/2760-71-0x0000000000610000-0x0000000000626000-memory.dmp

Filesize
88KB

Download
memory/2760-68-0x0000000000610000-0x0000000000626000-memory.dmp

Filesize
88KB

Download
memory/2772-11-0x0000000000400000-0x00000000009E9000-memory.dmp

Filesize
5.9MB

Download
memory/2772-7-0x0000000000400000-0x00000000009E9000-memory.dmp

Filesize
5.9MB

Download
memory/2772-13-0x0000000000400000-0x00000000009E9000-memory.dmp

Filesize
5.9MB

Download
memory/2772-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2772-18-0x0000000000400000-0x000000000040F1F7-memory.dmp

Filesize
60KB

Download
memory/2772-14-0x0000000000400000-0x00000000009E9000-memory.dmp

Filesize
5.9MB

Download
memory/2772-17-0x0000000000400000-0x00000000009E9000-memory.dmp

Filesize
5.9MB

Download
memory/2772-10-0x0000000000400000-0x00000000009E9000-memory.dmp

Filesize
5.9MB

Download
memory/2772-19-0x0000000000400000-0x00000000009E9000-memory.dmp

Filesize
5.9MB

Download
memory/2772-5-0x0000000000400000-0x00000000009E9000-memory.dmp

Filesize
5.9MB

Download
memory/2772-3-0x0000000000400000-0x00000000009E9000-memory.dmp

Filesize
5.9MB

Download
memory/2772-1-0x0000000000300000-0x0000000000400000-memory.dmp

Filesize
1024KB

Download
memory/2792-207-0x0000000000720000-0x00000000009A1000-memory.dmp

Filesize
2.5MB

Download
memory/2792-206-0x0000000000720000-0x00000000009A1000-memory.dmp

Filesize
2.5MB

Download
memory/2796-22-0x0000000000CE0000-0x0000000000F61000-memory.dmp

Filesize
2.5MB

Download
memory/2796-67-0x0000000000CE0000-0x0000000000F61000-memory.dmp

Filesize
2.5MB

Download
memory/2796-21-0x0000000000CE0000-0x0000000000F61000-memory.dmp

Filesize
2.5MB

Download
memory/2876-200-0x0000000000720000-0x00000000009A1000-memory.dmp

Filesize
2.5MB

Download
memory/2876-199-0x0000000000720000-0x00000000009A1000-memory.dmp

Filesize
2.5MB

Download