Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10_x64 -
resource
win10 -
submitted
24-06-2020 13:14
Static task
static1
Behavioral task
behavioral1
Sample
d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe
-
Size
351KB
-
MD5
391370b48b8f64f86c628742b03de53a
-
SHA1
0c4ef4daef2458ae999d2d3bf3ee837491369a25
-
SHA256
d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125
-
SHA512
62527b56eb597c1a177f154793f0734ed3e54df7dfd36e619f07a44cee2e22190920fbd15d34a5c8fcdd54853cbad95a797c6fbadc0f5f19ddf25b13945b4adf
Score
10/10
Malware Config
Signatures
-
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.html d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ode0ac.dat d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.html d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\ode0ac.dat d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2728 d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe 2728 d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe -
Suspicious use of AdjustPrivilegeToken 87 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3016 wmic.exe Token: SeSecurityPrivilege 3016 wmic.exe Token: SeTakeOwnershipPrivilege 3016 wmic.exe Token: SeLoadDriverPrivilege 3016 wmic.exe Token: SeSystemProfilePrivilege 3016 wmic.exe Token: SeSystemtimePrivilege 3016 wmic.exe Token: SeProfSingleProcessPrivilege 3016 wmic.exe Token: SeIncBasePriorityPrivilege 3016 wmic.exe Token: SeCreatePagefilePrivilege 3016 wmic.exe Token: SeBackupPrivilege 3016 wmic.exe Token: SeRestorePrivilege 3016 wmic.exe Token: SeShutdownPrivilege 3016 wmic.exe Token: SeDebugPrivilege 3016 wmic.exe Token: SeSystemEnvironmentPrivilege 3016 wmic.exe Token: SeRemoteShutdownPrivilege 3016 wmic.exe Token: SeUndockPrivilege 3016 wmic.exe Token: SeManageVolumePrivilege 3016 wmic.exe Token: 33 3016 wmic.exe Token: 34 3016 wmic.exe Token: 35 3016 wmic.exe Token: 36 3016 wmic.exe Token: SeIncreaseQuotaPrivilege 3016 wmic.exe Token: SeSecurityPrivilege 3016 wmic.exe Token: SeTakeOwnershipPrivilege 3016 wmic.exe Token: SeLoadDriverPrivilege 3016 wmic.exe Token: SeSystemProfilePrivilege 3016 wmic.exe Token: SeSystemtimePrivilege 3016 wmic.exe Token: SeProfSingleProcessPrivilege 3016 wmic.exe Token: SeIncBasePriorityPrivilege 3016 wmic.exe Token: SeCreatePagefilePrivilege 3016 wmic.exe Token: SeBackupPrivilege 3016 wmic.exe Token: SeRestorePrivilege 3016 wmic.exe Token: SeShutdownPrivilege 3016 wmic.exe Token: SeDebugPrivilege 3016 wmic.exe Token: SeSystemEnvironmentPrivilege 3016 wmic.exe Token: SeRemoteShutdownPrivilege 3016 wmic.exe Token: SeUndockPrivilege 3016 wmic.exe Token: SeManageVolumePrivilege 3016 wmic.exe Token: 33 3016 wmic.exe Token: 34 3016 wmic.exe Token: 35 3016 wmic.exe Token: 36 3016 wmic.exe Token: SeBackupPrivilege 3144 vssvc.exe Token: SeRestorePrivilege 3144 vssvc.exe Token: SeAuditPrivilege 3144 vssvc.exe Token: SeIncreaseQuotaPrivilege 2988 wmic.exe Token: SeSecurityPrivilege 2988 wmic.exe Token: SeTakeOwnershipPrivilege 2988 wmic.exe Token: SeLoadDriverPrivilege 2988 wmic.exe Token: SeSystemProfilePrivilege 2988 wmic.exe Token: SeSystemtimePrivilege 2988 wmic.exe Token: SeProfSingleProcessPrivilege 2988 wmic.exe Token: SeIncBasePriorityPrivilege 2988 wmic.exe Token: SeCreatePagefilePrivilege 2988 wmic.exe Token: SeBackupPrivilege 2988 wmic.exe Token: SeRestorePrivilege 2988 wmic.exe Token: SeShutdownPrivilege 2988 wmic.exe Token: SeDebugPrivilege 2988 wmic.exe Token: SeSystemEnvironmentPrivilege 2988 wmic.exe Token: SeRemoteShutdownPrivilege 2988 wmic.exe Token: SeUndockPrivilege 2988 wmic.exe Token: SeManageVolumePrivilege 2988 wmic.exe Token: 33 2988 wmic.exe Token: 34 2988 wmic.exe Token: 35 2988 wmic.exe Token: 36 2988 wmic.exe Token: SeIncreaseQuotaPrivilege 2988 wmic.exe Token: SeSecurityPrivilege 2988 wmic.exe Token: SeTakeOwnershipPrivilege 2988 wmic.exe Token: SeLoadDriverPrivilege 2988 wmic.exe Token: SeSystemProfilePrivilege 2988 wmic.exe Token: SeSystemtimePrivilege 2988 wmic.exe Token: SeProfSingleProcessPrivilege 2988 wmic.exe Token: SeIncBasePriorityPrivilege 2988 wmic.exe Token: SeCreatePagefilePrivilege 2988 wmic.exe Token: SeBackupPrivilege 2988 wmic.exe Token: SeRestorePrivilege 2988 wmic.exe Token: SeShutdownPrivilege 2988 wmic.exe Token: SeDebugPrivilege 2988 wmic.exe Token: SeSystemEnvironmentPrivilege 2988 wmic.exe Token: SeRemoteShutdownPrivilege 2988 wmic.exe Token: SeUndockPrivilege 2988 wmic.exe Token: SeManageVolumePrivilege 2988 wmic.exe Token: 33 2988 wmic.exe Token: 34 2988 wmic.exe Token: 35 2988 wmic.exe Token: 36 2988 wmic.exe -
Maze
Ransomware family also known as ChaCha.
-
Modifies service 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2728 wrote to memory of 3016 2728 d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe 67 PID 2728 wrote to memory of 3016 2728 d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe 67 PID 2728 wrote to memory of 2988 2728 d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe 72 PID 2728 wrote to memory of 2988 2728 d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe 72 -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\123456789.bmp" d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe"C:\Users\Admin\AppData\Local\Temp\d65fa9ed1220cfa12d22239ca62a4b5978bb613090fc1dcb0cccdf191151d125.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Sets desktop wallpaper using registry
PID:2728 -
C:\Windows\system32\wbem\wmic.exe"C:\e\..\Windows\lf\..\system32\owj\cdic\nngq\..\..\..\wbem\qdp\tard\..\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3016
-
-
C:\Windows\system32\wbem\wmic.exe"C:\wg\u\iymu\..\..\..\Windows\weokv\mouoy\vsg\..\..\..\system32\pe\lfwu\..\..\wbem\wbhic\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2988
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:3144