Analysis
-
max time kernel
137s -
max time network
139s -
platform
windows7_x64 -
resource
win7v200217 -
submitted
20-02-2020 12:57
Static task
static1
Behavioral task
behavioral1
Sample
b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe
Resource
win7v200217
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe
Resource
win10v200217
windows10_x64
0 signatures
0 seconds
General
-
Target
b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe
-
Size
1.1MB
-
MD5
bd9838d84fd77205011e8b0c2bd711e0
-
SHA1
c5938ec75e5b655be84eb94d73adec0f63fbce16
-
SHA256
b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1
-
SHA512
f1720e786f26f735956890b52ef913165b09661116becaaf7817ec757d56096d9a2c66a5bbfbc7b9a11791c145734f484de294fcb5b8c917e3837e48ded4df05
Score
10/10
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\000.bmp" b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1840 wrote to memory of 1588 1840 b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe 30 PID 1840 wrote to memory of 1588 1840 b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe 30 PID 1840 wrote to memory of 1588 1840 b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe 30 PID 1840 wrote to memory of 1588 1840 b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe 30 -
Modifies service 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe -
Maze
Ransomware family also known as ChaCha.
-
Drops startup file 6 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\6bbb0cb7253a540.tmp b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File created (read-only) C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6bbb0cb7253a540.tmp b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6bbb0cb7253a540.tmp b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File created (read-only) C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\6bbb0cb7253a540.tmp b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.txt b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1840 b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeBackupPrivilege 1984 vssvc.exe Token: SeRestorePrivilege 1984 vssvc.exe Token: SeAuditPrivilege 1984 vssvc.exe Token: SeIncreaseQuotaPrivilege 1588 wmic.exe Token: SeSecurityPrivilege 1588 wmic.exe Token: SeTakeOwnershipPrivilege 1588 wmic.exe Token: SeLoadDriverPrivilege 1588 wmic.exe Token: SeSystemProfilePrivilege 1588 wmic.exe Token: SeSystemtimePrivilege 1588 wmic.exe Token: SeProfSingleProcessPrivilege 1588 wmic.exe Token: SeIncBasePriorityPrivilege 1588 wmic.exe Token: SeCreatePagefilePrivilege 1588 wmic.exe Token: SeBackupPrivilege 1588 wmic.exe Token: SeRestorePrivilege 1588 wmic.exe Token: SeShutdownPrivilege 1588 wmic.exe Token: SeDebugPrivilege 1588 wmic.exe Token: SeSystemEnvironmentPrivilege 1588 wmic.exe Token: SeRemoteShutdownPrivilege 1588 wmic.exe Token: SeUndockPrivilege 1588 wmic.exe Token: SeManageVolumePrivilege 1588 wmic.exe Token: 33 1588 wmic.exe Token: 34 1588 wmic.exe Token: 35 1588 wmic.exe Token: SeIncreaseQuotaPrivilege 1588 wmic.exe Token: SeSecurityPrivilege 1588 wmic.exe Token: SeTakeOwnershipPrivilege 1588 wmic.exe Token: SeLoadDriverPrivilege 1588 wmic.exe Token: SeSystemProfilePrivilege 1588 wmic.exe Token: SeSystemtimePrivilege 1588 wmic.exe Token: SeProfSingleProcessPrivilege 1588 wmic.exe Token: SeIncBasePriorityPrivilege 1588 wmic.exe Token: SeCreatePagefilePrivilege 1588 wmic.exe Token: SeBackupPrivilege 1588 wmic.exe Token: SeRestorePrivilege 1588 wmic.exe Token: SeShutdownPrivilege 1588 wmic.exe Token: SeDebugPrivilege 1588 wmic.exe Token: SeSystemEnvironmentPrivilege 1588 wmic.exe Token: SeRemoteShutdownPrivilege 1588 wmic.exe Token: SeUndockPrivilege 1588 wmic.exe Token: SeManageVolumePrivilege 1588 wmic.exe Token: 33 1588 wmic.exe Token: 34 1588 wmic.exe Token: 35 1588 wmic.exe -
Drops file in Program Files directory 45 IoCs
description ioc Process File opened for modification C:\Program Files\6bbb0cb7253a540.tmp b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\Microsoft SQL Server Compact Edition\6bbb0cb7253a540.tmp b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files (x86)\6bbb0cb7253a540.tmp b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File created C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\RestartUninstall.midi b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\RestartUninstall.midi => C:\Program Files\RestartUninstall.midi.IvIOH b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\SuspendGrant.m4a => C:\Program Files\SuspendGrant.m4a.OCl9gL b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\EditRepair.mpv2 b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\GrantOpen.inf b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\MergeNew.cab b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\LockBackup.au b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\Desktop\6bbb0cb7253a540.tmp b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\ConvertToFormat.ini => C:\Program Files\ConvertToFormat.ini.uKMM b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\EditRepair.mpv2 => C:\Program Files\EditRepair.mpv2.3zA2Ar1 b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\GrantOpen.inf => C:\Program Files\GrantOpen.inf.HamiSmA b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\RestartSave.xltm => C:\Program Files\RestartSave.xltm.VCCOhm b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File created (read-only) C:\Program Files (x86)\6bbb0cb7253a540.tmp b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File created C:\Program Files\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File created C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\MoveWait.tif => C:\Program Files\MoveWait.tif.FFFk5m3 b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\SkipApprove.xhtml b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\SkipApprove.xhtml => C:\Program Files\SkipApprove.xhtml.WnJ8qIn b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\SplitRestart.bmp b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\UnpublishConvertTo.rmi b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\ConvertToFormat.ini b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\DisableCopy.M2T b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\ExpandProtect.ods => C:\Program Files\ExpandProtect.ods.3Kvh b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File created (read-only) C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\6bbb0cb7253a540.tmp b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\SplitRestart.bmp => C:\Program Files\SplitRestart.bmp.TthEv b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\UnpublishConvertTo.rmi => C:\Program Files\UnpublishConvertTo.rmi.WfdE2AZ b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\UnpublishSync.aifc => C:\Program Files\UnpublishSync.aifc.krlc b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\DisableCopy.M2T => C:\Program Files\DisableCopy.M2T.a23x0 b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\ExpandProtect.ods b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\LockBackup.au => C:\Program Files\LockBackup.au.8DWqy b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\MoveWait.tif b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\RestartSave.xltm b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File created C:\Program Files\DECRYPT-FILES.txt b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\MergeNew.cab => C:\Program Files\MergeNew.cab.J56bLX6 b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File created (read-only) C:\Program Files\Microsoft SQL Server Compact Edition\6bbb0cb7253a540.tmp b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\SuspendGrant.m4a b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\UnpublishSync.aifc b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File created (read-only) C:\Program Files\6bbb0cb7253a540.tmp b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\6bbb0cb7253a540.tmp b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File created (read-only) C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\Desktop\6bbb0cb7253a540.tmp b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe"C:\Users\Admin\AppData\Local\Temp\b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe"1⤵
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Drops file in Program Files directory
PID:1840 -
C:\Windows\system32\wbem\wmic.exe"C:\wbii\sosr\..\..\Windows\j\vhqf\..\..\system32\ccg\ky\v\..\..\..\wbem\ij\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1588
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1984
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵PID:736