Overview

overview

10

Static

static

ransomware

windows7_x64

10

Analysis

  • max time kernel
    102s
  • max time network
    271s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    03-05-2020 00:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe

  • Size

    997KB

  • MD5

    5425c30ebba4f84d1874a2c783932646

  • SHA1

    80db4a06b57e61695389c354f155c26bb125bd71

  • SHA256

    7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319

  • SHA512

    457b1539296379bd93adfbc8c3a172405f9c341d9d8aa1c6a8c1dbb0ff52ae564911b1a1218ec5613a5e9e2bcca0c00001d118fb36868391ee93f8155b304f1f

Score
10/10
ransomwareouroborosspywareevasionpersistence

Malware Config

Signatures

  • Modifies Windows Firewall 1 TTPs
    evasion
  • Ouroboros/Zeropadypt

    Ransomware family based on open-source CryptoWire.

    ransomwareouroboros
  • NTFS ADS 30 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Makes http(s) request 7 IoCs

    Contacts server via http/https, possibly for C2 communication.

  • Drops desktop.ini file(s) 256 IoCs
  • Modifies service 2 TTPs 10 IoCs
    persistence
  • Drops startup file 4 IoCs
  • Drops file in Windows directory 29381 IoCs
  • Drops file in System32 directory 11156 IoCs
  • Drops file in Drivers directory 9 IoCs
  • Suspicious use of WriteProcessMemory 124 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Drops file in Program Files directory 27513 IoCs
  • Runs net.exe

Processes

  • C:\Users\Admin\AppData\Local\Temp\7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe
    "C:\Users\Admin\AppData\Local\Temp\7550228f681474a038e957f86b84f182df3a1748aacf6cc7d60638f8b2784319.exe"
    1⤵
    • NTFS ADS
    • Drops desktop.ini file(s)
    • Drops startup file
    • Drops file in Windows directory
    • Drops file in System32 directory
    • Drops file in Drivers directory
    • Suspicious use of WriteProcessMemory
    • Suspicious behavior: EnumeratesProcesses
    • Drops file in Program Files directory
    PID:288
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net stop SQLWriter
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:112
      • C:\Windows\SysWOW64\net.exe
        net stop SQLWriter
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:800
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop SQLWriter
          4⤵
            PID:484
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c net stop SQLBrowser
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:740
        • C:\Windows\SysWOW64\net.exe
          net stop SQLBrowser
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1088
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop SQLBrowser
            4⤵
              PID:1056
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1508
          • C:\Windows\SysWOW64\net.exe
            net stop MSSQLSERVER
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1672
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop MSSQLSERVER
              4⤵
                PID:1356
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO1
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1368
            • C:\Windows\SysWOW64\net.exe
              net stop MSSQL$CONTOSO1
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1804
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop MSSQL$CONTOSO1
                4⤵
                  PID:1796
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c net stop MSDTC
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1812
              • C:\Windows\SysWOW64\net.exe
                net stop MSDTC
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1848
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop MSDTC
                  4⤵
                    PID:1836
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
                2⤵
                  PID:1864
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no
                  2⤵
                    PID:1880
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet
                    2⤵
                      PID:1784
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT
                      2⤵
                        PID:1764
                        • C:\Windows\SysWOW64\net.exe
                          net stop SQLSERVERAGENT
                          3⤵
                            PID:568
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 stop SQLSERVERAGENT
                              4⤵
                                PID:844
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
                            2⤵
                              PID:920
                              • C:\Windows\SysWOW64\net.exe
                                net stop MSSQLSERVER
                                3⤵
                                  PID:1224
                                  • C:\Windows\SysWOW64\net1.exe
                                    C:\Windows\system32\net1 stop MSSQLSERVER
                                    4⤵
                                      PID:1220
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c net stop vds
                                  2⤵
                                    PID:700
                                    • C:\Windows\SysWOW64\net.exe
                                      net stop vds
                                      3⤵
                                        PID:1120
                                        • C:\Windows\SysWOW64\net1.exe
                                          C:\Windows\system32\net1 stop vds
                                          4⤵
                                            PID:1732
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off
                                        2⤵
                                          PID:1624
                                          • C:\Windows\SysWOW64\netsh.exe
                                            netsh advfirewall set currentprofile state off
                                            3⤵
                                            • Modifies service
                                            PID:1580
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable
                                          2⤵
                                            PID:1540
                                            • C:\Windows\SysWOW64\netsh.exe
                                              netsh firewall set opmode mode=disable
                                              3⤵
                                              • Modifies service
                                              PID:1976

                                        Network

                                        MITRE ATT&CK Matrix ATT&CK v6

                                        Initial Access

                                        Execution

                                        Persistence

                                        Modify Existing Service

                                        2
                                        T1031

                                        Privilege Escalation

                                        Defense Evasion

                                        Modify Registry

                                        1
                                        T1112

                                        Credential Access

                                        Credentials in Files

                                        1
                                        T1081

                                        Discovery

                                        Lateral Movement

                                        Collection

                                        Data from Local System

                                        1
                                        T1005

                                        Exfiltration

                                        Command and Control

                                        Impact

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • memory/288-0-0x0000000000FC0000-0x0000000000FD1000-memory.dmp
                                          Filesize

                                          68KB

                                          Download
                                        • memory/288-1-0x00000000013D0000-0x00000000013E1000-memory.dmp
                                          Filesize

                                          68KB

                                          Download
                                        • memory/288-2-0x0000000000FC0000-0x0000000000FD1000-memory.dmp
                                          Filesize

                                          68KB

                                          Download