cryptopatronum | 458ad7362cfb6980b9e7eb19ab83ddc6d261bf6b057f1892267dd55c656e9686

General

Target
458ad7362cfb6980b9e7eb19ab83ddc6d261bf6b057f1892267dd55c656e9686.exe
Size 23KB
Sample260520-dbkn7ah19k
SHA256 458ad7362cfb6980b9e7eb19ab83ddc6d261bf6b057f1892267dd55c656e9686
MD5 6362ff59e775cca4d1da38cacaae58be
SHA1 2c992f5a53bbe80030604ea8f3d121eae6bb7432
SHA512 c1c26ef8a6f8d391ee92b084caca5dc13301b3d6e773b41c202e5607ae21034813e4e47857a7e786936fff025e8dba66c9eccd276697aaf1df2ce14431cc9c87
SSDEEP 384:7XGEIh4HIHEKRXfQJ/1/1mORKun6psaJbKe8NebZ9WTq70piYSc:n72ol1eJbsML70QY9
TLSH
T166B2721477FC5632F2FA2F7999B251610B39B99AEC39CA5C1948100D4CA3B88C9F1B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution cryptopatronum impact persistence ransomware

Malware Config

Signatures

Family: CryptoPatronum
CryptoPatronum is a Windows ransomware written in C#.
ransomware cryptopatronum

Detects CryptoPatronum ransomware 2 IoCs

resource	yara_rule
behavioral2/memory/3388-0-0x000002910A4F0000-0x000002910A4FC000-memory.dmp	family_cryptopatronum
behavioral2/memory/3388-3-0x000002910AA10000-0x000002910AA20000-memory.dmp	family_cryptopatronum

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\windows\\wininit.exe"	reg.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Discovers systems in the same network 1 TTPs 1 IoCs

discovery

Remote System Discovery

T1018

pid	Process
868	net.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4900	vssadmin.exe
4652	vssadmin.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2244	taskkill.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3388	458ad7362cfb6980b9e7eb19ab83ddc6d261bf6b057f1892267dd55c656e9686.exe
Token: SeDebugPrivilege	2244	taskkill.exe
Token: SeBackupPrivilege	3364	vssvc.exe
Token: SeRestorePrivilege	3364	vssvc.exe
Token: SeAuditPrivilege	3364	vssvc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 4900	3388	458ad7362cfb6980b9e7eb19ab83ddc6d261bf6b057f1892267dd55c656e9686.exe	80
PID 3388 wrote to memory of 868	3388	458ad7362cfb6980b9e7eb19ab83ddc6d261bf6b057f1892267dd55c656e9686.exe	82
PID 3388 wrote to memory of 4652	3388	458ad7362cfb6980b9e7eb19ab83ddc6d261bf6b057f1892267dd55c656e9686.exe	84
PID 3388 wrote to memory of 2244	3388	458ad7362cfb6980b9e7eb19ab83ddc6d261bf6b057f1892267dd55c656e9686.exe	85
PID 3388 wrote to memory of 3440	3388	458ad7362cfb6980b9e7eb19ab83ddc6d261bf6b057f1892267dd55c656e9686.exe	88
PID 3388 wrote to memory of 4304	3388	458ad7362cfb6980b9e7eb19ab83ddc6d261bf6b057f1892267dd55c656e9686.exe	89
PID 3388 wrote to memory of 1048	3388	458ad7362cfb6980b9e7eb19ab83ddc6d261bf6b057f1892267dd55c656e9686.exe	90
PID 868 wrote to memory of 3772	868	net.exe	93
PID 1048 wrote to memory of 1112	1048	net.exe	96

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\458ad7362cfb6980b9e7eb19ab83ddc6d261bf6b057f1892267dd55c656e9686.exe
"C:\Users\Admin\AppData\Local\Temp\458ad7362cfb6980b9e7eb19ab83ddc6d261bf6b057f1892267dd55c656e9686.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4900
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop TeamViewer /y
  2⤵
  - Discovers systems in the same network
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop TeamViewer /y
    3⤵
    PID:3772
- C:\Windows\System32\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4652
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im 1cv8.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2244
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 1 /f
  2⤵
  PID:3440
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "wininit" /t REG_SZ /F /D "C:\windows\wininit.exe"
  2⤵
  - Adds Run key to start application
  PID:4304
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop mssqlserver /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop mssqlserver /y
    3⤵
    PID:1112