Analysis
-
max time kernel
108s -
max time network
115s -
platform
windows7_x64 -
resource
win7v200410 -
submitted
20-04-2020 15:41
Static task
static1
Behavioral task
behavioral1
Sample
launch.bat
Resource
win7v200410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
launch.bat
Resource
win10v200410
windows10_x64
0 signatures
0 seconds
General
-
Target
launch.bat
-
Size
68B
-
MD5
fc9df43a0e518e46173810698bb61f2b
-
SHA1
d349c3a95356d0f97707b79495753bd03653f629
-
SHA256
d74870a0ba0e9cc7388bef1b4de9c09f6316a9ccf8e3191cdf6809e8032873ad
-
SHA512
84fec80449e9b5b1ddb150f6bda64b79435a38111273ab57e92a4ceeaa44c4c320eb9e02cc5384dbf281e52c936b14602826c54c8999e9df23cfe7e5800293d0
Score
10/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1664 regsvr32.exe -
Modifies service 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Maze
Ransomware family also known as ChaCha.
-
Drops file in Program Files directory 23 IoCs
description ioc Process File opened for modification C:\Program Files\ResumeInitialize.ps1 regsvr32.exe File opened for modification C:\Program Files\SuspendGet.odt regsvr32.exe File opened for modification C:\Program Files (x86)\6ac70c8f4f75dce3.tmp regsvr32.exe File opened for modification C:\Program Files\CompleteUninstall.dotx regsvr32.exe File created C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\DECRYPT-FILES.txt regsvr32.exe File created C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\Desktop\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Program Files\OpenLimit.lock regsvr32.exe File opened for modification C:\Program Files\Microsoft SQL Server Compact Edition\6ac70c8f4f75dce3.tmp regsvr32.exe File opened for modification C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\Desktop\6ac70c8f4f75dce3.tmp regsvr32.exe File opened for modification C:\Program Files\RegisterUnregister.mpg regsvr32.exe File opened for modification C:\Program Files\ConvertToRestore.ttc regsvr32.exe File opened for modification C:\Program Files\DisableUndo.au3 regsvr32.exe File opened for modification C:\Program Files\JoinClear.pptm regsvr32.exe File opened for modification C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\6ac70c8f4f75dce3.tmp regsvr32.exe File created C:\Program Files\Microsoft SQL Server Compact Edition\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Program Files\SaveRepair.emz regsvr32.exe File opened for modification C:\Program Files\SwitchUnprotect.wm regsvr32.exe File opened for modification C:\Program Files\UpdateUnpublish.xht regsvr32.exe File created C:\Program Files\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Program Files\6ac70c8f4f75dce3.tmp regsvr32.exe File opened for modification C:\Program Files\EnableSync.edrwx regsvr32.exe File opened for modification C:\Program Files\LimitGrant.snd regsvr32.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt regsvr32.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3765897441-2376744223-3151462503-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\111.bmp" regsvr32.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 1672 regsvr32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1588 wrote to memory of 1672 1588 cmd.exe 27 PID 1672 wrote to memory of 1664 1672 regsvr32.exe 28 PID 1672 wrote to memory of 1664 1672 regsvr32.exe 28 PID 1672 wrote to memory of 1664 1672 regsvr32.exe 28 PID 1672 wrote to memory of 1664 1672 regsvr32.exe 28 PID 1672 wrote to memory of 1664 1672 regsvr32.exe 28 PID 1672 wrote to memory of 1664 1672 regsvr32.exe 28 PID 1672 wrote to memory of 1664 1672 regsvr32.exe 28 PID 1664 wrote to memory of 2012 1664 regsvr32.exe 33 PID 1664 wrote to memory of 2012 1664 regsvr32.exe 33 PID 1664 wrote to memory of 2012 1664 regsvr32.exe 33 PID 1664 wrote to memory of 2012 1664 regsvr32.exe 33 -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeBackupPrivilege 1696 vssvc.exe Token: SeRestorePrivilege 1696 vssvc.exe Token: SeAuditPrivilege 1696 vssvc.exe Token: SeIncreaseQuotaPrivilege 2012 wmic.exe Token: SeSecurityPrivilege 2012 wmic.exe Token: SeTakeOwnershipPrivilege 2012 wmic.exe Token: SeLoadDriverPrivilege 2012 wmic.exe Token: SeSystemProfilePrivilege 2012 wmic.exe Token: SeSystemtimePrivilege 2012 wmic.exe Token: SeProfSingleProcessPrivilege 2012 wmic.exe Token: SeIncBasePriorityPrivilege 2012 wmic.exe Token: SeCreatePagefilePrivilege 2012 wmic.exe Token: SeBackupPrivilege 2012 wmic.exe Token: SeRestorePrivilege 2012 wmic.exe Token: SeShutdownPrivilege 2012 wmic.exe Token: SeDebugPrivilege 2012 wmic.exe Token: SeSystemEnvironmentPrivilege 2012 wmic.exe Token: SeRemoteShutdownPrivilege 2012 wmic.exe Token: SeUndockPrivilege 2012 wmic.exe Token: SeManageVolumePrivilege 2012 wmic.exe Token: 33 2012 wmic.exe Token: 34 2012 wmic.exe Token: 35 2012 wmic.exe Token: SeIncreaseQuotaPrivilege 2012 wmic.exe Token: SeSecurityPrivilege 2012 wmic.exe Token: SeTakeOwnershipPrivilege 2012 wmic.exe Token: SeLoadDriverPrivilege 2012 wmic.exe Token: SeSystemProfilePrivilege 2012 wmic.exe Token: SeSystemtimePrivilege 2012 wmic.exe Token: SeProfSingleProcessPrivilege 2012 wmic.exe Token: SeIncBasePriorityPrivilege 2012 wmic.exe Token: SeCreatePagefilePrivilege 2012 wmic.exe Token: SeBackupPrivilege 2012 wmic.exe Token: SeRestorePrivilege 2012 wmic.exe Token: SeShutdownPrivilege 2012 wmic.exe Token: SeDebugPrivilege 2012 wmic.exe Token: SeSystemEnvironmentPrivilege 2012 wmic.exe Token: SeRemoteShutdownPrivilege 2012 wmic.exe Token: SeUndockPrivilege 2012 wmic.exe Token: SeManageVolumePrivilege 2012 wmic.exe Token: 33 2012 wmic.exe Token: 34 2012 wmic.exe Token: 35 2012 wmic.exe -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\6ac70c8f4f75dce3.tmp regsvr32.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt regsvr32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6ac70c8f4f75dce3.tmp regsvr32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\launch.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\system32\regsvr32.exeregsvr32 "C:\Users\Admin\AppData\Local\temp\kepstl32.dll"2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Users\Admin\AppData\Local\temp\kepstl32.dll"3⤵
- Suspicious behavior: EnumeratesProcesses
- Drops file in Program Files directory
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
- Drops startup file
PID:1664 -
C:\Windows\system32\wbem\wmic.exe"C:\p\m\cwmsx\..\..\..\Windows\hyc\hfece\..\..\system32\qlc\s\mk\..\..\..\wbem\iya\masq\e\..\..\..\wmic.exe" shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2012
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1696
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵PID:1172