aebf032aa3e567c208589867ce7a3f67aacd68a5beab36ff16d8a49339d57f8d

General

Target
$PLUGINSDIR/runtimes.exe
Size 12.7MB
Sample260928-e6stqage74
SHA256 aebf032aa3e567c208589867ce7a3f67aacd68a5beab36ff16d8a49339d57f8d
MD5 b36910049318d32ad743a2b2fd20756c
SHA1 b17961f97d950b81633c30401f31a4db3ff6f4b3
SHA512 b62a04a0332a29d5781f23b44ea497456bb39f7da6c0deb7e8e60ec58fdace0e5374b6b09d8003bf05e446b295cac54026472066e47ba8ebf66965ef6a18518f
SSDEEP 393216:iq+VmyJx6aOkZ9t9gj6Jzm88UTF4Fw8Lcgv90Sz0:iLV3D6ajd9gI8Ul8IA05
TLSH
T1D0D6331871AC7232DDF315B8EE3A1B761D61F429E258E02CE51C5F69F1234B06ABD2E4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1832	vc14_x86.exe
1076	vc14_x86.exe
904	VC_redist.x86.exe

Loads dropped DLL 1 IoCs

pid	Process
1076	vc14_x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runtimes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc14_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc14_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x86.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000040fd3fc73d5da4b20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000040fd3fc70000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090040fd3fc7000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a40fd3fc7000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d40fd3fc7000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	2508	vssvc.exe
Token: SeRestorePrivilege	2508	vssvc.exe
Token: SeAuditPrivilege	2508	vssvc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3748 wrote to memory of 1832	3748	runtimes.exe	81
PID 1832 wrote to memory of 1076	1832	vc14_x86.exe	82
PID 1076 wrote to memory of 904	1076	vc14_x86.exe	83

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\runtimes.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\runtimes.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Users\Admin\AppData\Local\Temp\nsa4498.tmp\vc14_x86.exe
  "C:\Users\Admin\AppData\Local\Temp\nsa4498.tmp\vc14_x86.exe" /install /quiet /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\Temp\{824696EC-9019-44EC-A68B-79875B0E092C}\.cr\vc14_x86.exe
    "C:\Windows\Temp\{824696EC-9019-44EC-A68B-79875B0E092C}\.cr\vc14_x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\nsa4498.tmp\vc14_x86.exe" -burn.filehandle.attached=724 -burn.filehandle.self=728 /install /quiet /norestart
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1076
  - - C:\Windows\Temp\{EE30B468-0D97-4512-9FE6-52E54C247B9E}\.be\VC_redist.x86.exe
      "C:\Windows\Temp\{EE30B468-0D97-4512-9FE6-52E54C247B9E}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{E405EBB3-5F2D-463F-A5FE-829A2AA36FF4} {2EDA013B-A54C-4845-B0D4-CCB4E0641236} 1076
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:904

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vc14_x86.exe

Path C:\Users\Admin\AppData\Local\Temp\nsa4498.tmp\vc14_x86.exe
Size 6.6MB
SHA256 f0bab33a302b3cdb2e11113760d016f54fd3d2632c65ba7834fac4f0abd7f1a3
MD5 8f442d99f1a6bbd563bac8a3cc39953d
SHA1 4e6b716f6144f56e527771fd518de049afb7fa66
SHA512 df8e1806e5fb27522e9f985a21ee79c1853bbdaf8a9f3f586e6033ef67f864c578c0673b6eefb86e915e16004a42d262d504d000910d9cfc403f5a7f78fcb575
SSDEEP 196608:aLZUOEpi9NAIDjaCF7vomfTamgujlukvSJPWd6hzk:OeYQAjaCF7QUgujYfJPWd6hzk
TLSH
T10A662332A0A51033EBF111B7A928A5303D7CF3282B15C8ADD3D8AD1D3D658E5A7F7256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc14_x86.exe

Path C:\Windows\Temp\{824696EC-9019-44EC-A68B-79875B0E092C}\.cr\vc14_x86.exe
Size 614KB
SHA256 dd985380ee5288472e68d5e0943cae957729a86588cd8e5d39b97aefd06595c0
MD5 b860001d911788310550b8cd8fa60b88
SHA1 e9c79129e122433f1ff4bbf0e60dbdccaeb9f8af
SHA512 30a6d22e533c9ee4b7d4ad34aca7c5ba1e55cbdf9fc96f32e98197463cd7474148238c9baae7ec8cbba56f81e2ac1ade3a30763a1b32c6f8f1c2399b9bb175d8
SSDEEP 12288:a3mgqnIZuYfCYqFet4CovkM7chYnE2Pz8Sor:a3WnIZuMCxezot7qgZzTs
TLSH
T1C4D48D32A5614033FBF10573B928A6303E7CE7282B5188A9D7D4BD1D7EA48D1A7F7216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{EE30B468-0D97-4512-9FE6-52E54C247B9E}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{EE30B468-0D97-4512-9FE6-52E54C247B9E}\.ba\wixstdba.dll
Size 215KB
SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
MD5 f68f43f809840328f4e993a54b0d5e62
SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
TLSH
T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads