Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7 -
submitted
24-06-2020 13:14
Static task
static1
Behavioral task
behavioral1
Sample
d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe
-
Size
351KB
-
MD5
391370b48b8f64f86c628742b03de53a
-
SHA1
0c4ef4daef2458ae999d2d3bf3ee837491369a25
-
SHA256
d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125
-
SHA512
62527b56eb597c1a177f154793f0734ed3e54df7dfd36e619f07a44cee2e22190920fbd15d34a5c8fcdd54853cbad95a797c6fbadc0f5f19ddf25b13945b4adf
Score
10/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 83 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1604 wmic.exe Token: SeSecurityPrivilege 1604 wmic.exe Token: SeTakeOwnershipPrivilege 1604 wmic.exe Token: SeLoadDriverPrivilege 1604 wmic.exe Token: SeSystemProfilePrivilege 1604 wmic.exe Token: SeSystemtimePrivilege 1604 wmic.exe Token: SeProfSingleProcessPrivilege 1604 wmic.exe Token: SeIncBasePriorityPrivilege 1604 wmic.exe Token: SeCreatePagefilePrivilege 1604 wmic.exe Token: SeBackupPrivilege 1604 wmic.exe Token: SeRestorePrivilege 1604 wmic.exe Token: SeShutdownPrivilege 1604 wmic.exe Token: SeDebugPrivilege 1604 wmic.exe Token: SeSystemEnvironmentPrivilege 1604 wmic.exe Token: SeRemoteShutdownPrivilege 1604 wmic.exe Token: SeUndockPrivilege 1604 wmic.exe Token: SeManageVolumePrivilege 1604 wmic.exe Token: 33 1604 wmic.exe Token: 34 1604 wmic.exe Token: 35 1604 wmic.exe Token: SeIncreaseQuotaPrivilege 1604 wmic.exe Token: SeSecurityPrivilege 1604 wmic.exe Token: SeTakeOwnershipPrivilege 1604 wmic.exe Token: SeLoadDriverPrivilege 1604 wmic.exe Token: SeSystemProfilePrivilege 1604 wmic.exe Token: SeSystemtimePrivilege 1604 wmic.exe Token: SeProfSingleProcessPrivilege 1604 wmic.exe Token: SeIncBasePriorityPrivilege 1604 wmic.exe Token: SeCreatePagefilePrivilege 1604 wmic.exe Token: SeBackupPrivilege 1604 wmic.exe Token: SeRestorePrivilege 1604 wmic.exe Token: SeShutdownPrivilege 1604 wmic.exe Token: SeDebugPrivilege 1604 wmic.exe Token: SeSystemEnvironmentPrivilege 1604 wmic.exe Token: SeRemoteShutdownPrivilege 1604 wmic.exe Token: SeUndockPrivilege 1604 wmic.exe Token: SeManageVolumePrivilege 1604 wmic.exe Token: 33 1604 wmic.exe Token: 34 1604 wmic.exe Token: 35 1604 wmic.exe Token: SeBackupPrivilege 1500 vssvc.exe Token: SeRestorePrivilege 1500 vssvc.exe Token: SeAuditPrivilege 1500 vssvc.exe Token: SeIncreaseQuotaPrivilege 1600 wmic.exe Token: SeSecurityPrivilege 1600 wmic.exe Token: SeTakeOwnershipPrivilege 1600 wmic.exe Token: SeLoadDriverPrivilege 1600 wmic.exe Token: SeSystemProfilePrivilege 1600 wmic.exe Token: SeSystemtimePrivilege 1600 wmic.exe Token: SeProfSingleProcessPrivilege 1600 wmic.exe Token: SeIncBasePriorityPrivilege 1600 wmic.exe Token: SeCreatePagefilePrivilege 1600 wmic.exe Token: SeBackupPrivilege 1600 wmic.exe Token: SeRestorePrivilege 1600 wmic.exe Token: SeShutdownPrivilege 1600 wmic.exe Token: SeDebugPrivilege 1600 wmic.exe Token: SeSystemEnvironmentPrivilege 1600 wmic.exe Token: SeRemoteShutdownPrivilege 1600 wmic.exe Token: SeUndockPrivilege 1600 wmic.exe Token: SeManageVolumePrivilege 1600 wmic.exe Token: 33 1600 wmic.exe Token: 34 1600 wmic.exe Token: 35 1600 wmic.exe Token: SeIncreaseQuotaPrivilege 1600 wmic.exe Token: SeSecurityPrivilege 1600 wmic.exe Token: SeTakeOwnershipPrivilege 1600 wmic.exe Token: SeLoadDriverPrivilege 1600 wmic.exe Token: SeSystemProfilePrivilege 1600 wmic.exe Token: SeSystemtimePrivilege 1600 wmic.exe Token: SeProfSingleProcessPrivilege 1600 wmic.exe Token: SeIncBasePriorityPrivilege 1600 wmic.exe Token: SeCreatePagefilePrivilege 1600 wmic.exe Token: SeBackupPrivilege 1600 wmic.exe Token: SeRestorePrivilege 1600 wmic.exe Token: SeShutdownPrivilege 1600 wmic.exe Token: SeDebugPrivilege 1600 wmic.exe Token: SeSystemEnvironmentPrivilege 1600 wmic.exe Token: SeRemoteShutdownPrivilege 1600 wmic.exe Token: SeUndockPrivilege 1600 wmic.exe Token: SeManageVolumePrivilege 1600 wmic.exe Token: 33 1600 wmic.exe Token: 34 1600 wmic.exe Token: 35 1600 wmic.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.html d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mq36p.dat d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.html d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\mq36p.dat d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1456 d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1456 wrote to memory of 1604 1456 d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe 24 PID 1456 wrote to memory of 1604 1456 d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe 24 PID 1456 wrote to memory of 1604 1456 d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe 24 PID 1456 wrote to memory of 1604 1456 d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe 24 PID 1456 wrote to memory of 1600 1456 d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe 30 PID 1456 wrote to memory of 1600 1456 d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe 30 PID 1456 wrote to memory of 1600 1456 d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe 30 PID 1456 wrote to memory of 1600 1456 d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe 30 -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\123456789.bmp" d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe -
Maze
Ransomware family also known as ChaCha.
-
Modifies service 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe"C:\Users\Admin\AppData\Local\Temp\d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Sets desktop wallpaper using registry
PID:1456 -
C:\Windows\system32\wbem\wmic.exe"C:\w\l\t\..\..\..\Windows\k\o\hhki\..\..\..\system32\wk\..\wbem\rniqa\rmlk\wkoqo\..\..\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1604
-
-
C:\Windows\system32\wbem\wmic.exe"C:\acv\byhl\..\..\Windows\rxnlh\..\system32\geyc\..\wbem\wskxk\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1600
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:1500
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵PID:1928