Analysis
-
max time kernel
111s -
max time network
117s -
platform
windows10_x64 -
resource
win10v200217 -
submitted
20-02-2020 12:57
Static task
static1
Behavioral task
behavioral1
Sample
b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe
Resource
win7v200217
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe
Resource
win10v200217
windows10_x64
0 signatures
0 seconds
General
-
Target
b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe
-
Size
1.1MB
-
MD5
bd9838d84fd77205011e8b0c2bd711e0
-
SHA1
c5938ec75e5b655be84eb94d73adec0f63fbce16
-
SHA256
b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1
-
SHA512
f1720e786f26f735956890b52ef913165b09661116becaaf7817ec757d56096d9a2c66a5bbfbc7b9a11791c145734f484de294fcb5b8c917e3837e48ded4df05
Score
10/10
Malware Config
Signatures
-
Drops file in Program Files directory 44 IoCs
description ioc Process File opened for modification C:\Program Files\ImportClose.jpeg b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\RepairAssert.MOD b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\SaveUnpublish.vstx b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\SkipResolve.ps1 b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\SplitHide.cmd => C:\Program Files\SplitHide.cmd.qropagX b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\SubmitFormat.dotx b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\UnblockConvertFrom.vsdm b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\GroupUnlock.emf => C:\Program Files\GroupUnlock.emf.5OqFXW b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\NewDisable.hta b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\RepairAssert.MOD => C:\Program Files\RepairAssert.MOD.LVyCc b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\ResetStep.mht => C:\Program Files\ResetStep.mht.0bvV b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\ExpandDebug.edrwx => C:\Program Files\ExpandDebug.edrwx.2hfY b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\ExpandDebug.edrwx b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\ResizePop.rar => C:\Program Files\ResizePop.rar.Lpvpn b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\SplitHide.cmd b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File created (read-only) C:\Program Files\6bd50cb0351f0339.tmp b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\RequestWait.raw => C:\Program Files\RequestWait.raw.pUjbkVs b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\SaveUnpublish.vstx => C:\Program Files\SaveUnpublish.vstx.Lpvpn b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\SearchSwitch.wpl b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\SubmitFormat.dotx => C:\Program Files\SubmitFormat.dotx.f5yV b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File created (read-only) C:\Program Files (x86)\6bd50cb0351f0339.tmp b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\HideAdd.ini => C:\Program Files\HideAdd.ini.F1qqbz6 b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\BlockStep.zip => C:\Program Files\BlockStep.zip.128i b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\ConvertFromReset.temp => C:\Program Files\ConvertFromReset.temp.DRgDznq b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\RequestWait.raw b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\ResetStep.mht b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\SkipResolve.ps1 => C:\Program Files\SkipResolve.ps1.pMV4oM b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\6bd50cb0351f0339.tmp b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\ConvertFromReset.temp b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\GroupUnlock.emf b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\ResizePop.rar b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\UnblockConvertFrom.vsdm => C:\Program Files\UnblockConvertFrom.vsdm.wNGm b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\ApproveUninstall.xsl b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\ApproveUninstall.xsl => C:\Program Files\ApproveUninstall.xsl.Sy9XjTy b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\UseSearch.wav => C:\Program Files\UseSearch.wav.8rcwZ b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files (x86)\6bd50cb0351f0339.tmp b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File created C:\Program Files\DECRYPT-FILES.txt b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\HideAdd.ini b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\ImportClose.jpeg => C:\Program Files\ImportClose.jpeg.9DMqa7G b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\NewDisable.hta => C:\Program Files\NewDisable.hta.opqYg3 b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File renamed C:\Program Files\SearchSwitch.wpl => C:\Program Files\SearchSwitch.wpl.a5UCxKy b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\UseSearch.wav b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Program Files\BlockStep.zip b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe -
Drops startup file 6 IoCs
description ioc Process File created (read-only) C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6bd50cb0351f0339.tmp b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6bd50cb0351f0339.tmp b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File created (read-only) C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\6bd50cb0351f0339.tmp b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.txt b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\6bd50cb0351f0339.tmp b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-638615289-2068236702-2426684043-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\000.bmp" b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3972 b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe 3972 b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeBackupPrivilege 3004 vssvc.exe Token: SeRestorePrivilege 3004 vssvc.exe Token: SeAuditPrivilege 3004 vssvc.exe Token: SeIncreaseQuotaPrivilege 4048 wmic.exe Token: SeSecurityPrivilege 4048 wmic.exe Token: SeTakeOwnershipPrivilege 4048 wmic.exe Token: SeLoadDriverPrivilege 4048 wmic.exe Token: SeSystemProfilePrivilege 4048 wmic.exe Token: SeSystemtimePrivilege 4048 wmic.exe Token: SeProfSingleProcessPrivilege 4048 wmic.exe Token: SeIncBasePriorityPrivilege 4048 wmic.exe Token: SeCreatePagefilePrivilege 4048 wmic.exe Token: SeBackupPrivilege 4048 wmic.exe Token: SeRestorePrivilege 4048 wmic.exe Token: SeShutdownPrivilege 4048 wmic.exe Token: SeDebugPrivilege 4048 wmic.exe Token: SeSystemEnvironmentPrivilege 4048 wmic.exe Token: SeRemoteShutdownPrivilege 4048 wmic.exe Token: SeUndockPrivilege 4048 wmic.exe Token: SeManageVolumePrivilege 4048 wmic.exe Token: 33 4048 wmic.exe Token: 34 4048 wmic.exe Token: 35 4048 wmic.exe Token: 36 4048 wmic.exe Token: SeIncreaseQuotaPrivilege 4048 wmic.exe Token: SeSecurityPrivilege 4048 wmic.exe Token: SeTakeOwnershipPrivilege 4048 wmic.exe Token: SeLoadDriverPrivilege 4048 wmic.exe Token: SeSystemProfilePrivilege 4048 wmic.exe Token: SeSystemtimePrivilege 4048 wmic.exe Token: SeProfSingleProcessPrivilege 4048 wmic.exe Token: SeIncBasePriorityPrivilege 4048 wmic.exe Token: SeCreatePagefilePrivilege 4048 wmic.exe Token: SeBackupPrivilege 4048 wmic.exe Token: SeRestorePrivilege 4048 wmic.exe Token: SeShutdownPrivilege 4048 wmic.exe Token: SeDebugPrivilege 4048 wmic.exe Token: SeSystemEnvironmentPrivilege 4048 wmic.exe Token: SeRemoteShutdownPrivilege 4048 wmic.exe Token: SeUndockPrivilege 4048 wmic.exe Token: SeManageVolumePrivilege 4048 wmic.exe Token: 33 4048 wmic.exe Token: 34 4048 wmic.exe Token: 35 4048 wmic.exe Token: 36 4048 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3972 wrote to memory of 4048 3972 b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe 71 PID 3972 wrote to memory of 4048 3972 b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe 71 -
Modifies service 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe -
Maze
Ransomware family also known as ChaCha.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe"C:\Users\Admin\AppData\Local\Temp\b345697c16f84d3775924dc17847fa3ff61579ee793a95248e9c4964da586dd1.bin.exe"1⤵
- Drops file in Program Files directory
- Drops startup file
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Windows\system32\wbem\wmic.exe"C:\j\..\Windows\xyf\vso\xfth\..\..\..\system32\eqp\voea\..\..\wbem\xktq\dqarf\..\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4048
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:3004