Malware Analysis Series

Akira_DeleteShadowCopies: Inhibit System Recovery (T1490)

How it works:

  1. The command is built from a stack string and decoded with a mod-127 formula, which changed between builds: build 1 uses ((0x39 − b)·0x0B) mod 0x7F, build 2 uses ((0x32 − b)·0x2A) mod 0x7F.

  2. Both builds decode to:

    powershell.exe -Command "Get-WmiObject Win32_Shadowcopy | Remove-WmiObject"
  3. The command is passed to WMI Win32_Process.Create in ROOT\CIMV2 with Win32_ProcessStartup.ShowWindow = 0. So the visible parent is WmiPrvSE.exe.
  4. The sample waits up to 15 s for that process.

Functions:

  Build 1 Build 2
Decoder FUN_140071d80 FUN_140078ff0
WMI executor FUN_140071620 FUN_140078890

In every controlled run, the executor was forced to return before it could act.

Related techniques: T1047, T1059.001 and T1564.003.

Code: not recreated. Detection: Detection/.