Analysis

  • max time kernel
    43s
  • max time network
    55s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    25-06-2020 05:31

General

  • Target

    5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe

  • Size

    1.0MB

  • MD5

    572fea5f025df78f2d316216fbeee52e

  • SHA1

    91b2bf44b1f9282c09f07f16631deaa3ad9d956d

  • SHA256

    5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367

  • SHA512

    eb238272227c5825477ff1e37dc4f7e467665049d4db5649fff59c39d7745e88b06234d6d1218c05c802e33e21577f9d4a533cb9e23ebe6fb09654f97759c187

Malware Config

Signatures

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies service 2 TTPs 5 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • NTFS ADS 1 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Possible privilege escalation attempt 2 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Drops file in System32 directory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe
    "C:\Users\Admin\AppData\Local\Temp\5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    • NTFS ADS
    PID:1412
    • C:\Users\Admin\AppData\Roaming\Usbstor:bin
      C:\Users\Admin\AppData\Roaming\Usbstor:bin -r
      2⤵
      • Suspicious use of WriteProcessMemory
      • Executes dropped EXE
      • Drops file in System32 directory
      PID:1448
      • C:\Windows\system32\vssadmin.exe
        C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • Interacts with shadow copies
        PID:1092
      • C:\Windows\SysWOW64\takeown.exe
        C:\Windows\system32\takeown.exe /F C:\Windows\system32\Usbstor.exe
        3⤵
        • Modifies file permissions
        • Possible privilege escalation attempt
        PID:1812
      • C:\Windows\SysWOW64\icacls.exe
        C:\Windows\system32\icacls.exe C:\Windows\system32\Usbstor.exe /reset
        3⤵
        • Modifies file permissions
        • Possible privilege escalation attempt
        PID:1832
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Roaming\Usbstor" & del "C:\Users\Admin\AppData\Roaming\Usbstor"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1768
        • C:\Windows\SysWOW64\choice.exe
          choice /t 10 /d y
          4⤵
            PID:1604
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h "C:\Users\Admin\AppData\Roaming\Usbstor"
            4⤵
            • Views/modifies file attributes
            PID:1580
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe" & del "C:\Users\Admin\AppData\Local\Temp\5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        • Deletes itself
        PID:1788
        • C:\Windows\SysWOW64\choice.exe
          choice /t 10 /d y
          3⤵
            PID:1588
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h "C:\Users\Admin\AppData\Local\Temp\5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe"
            3⤵
            • Views/modifies file attributes
            PID:1568
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Modifies service
        • Suspicious use of AdjustPrivilegeToken
        PID:788

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Modify Existing Service

      1
      T1031

      Hidden Files and Directories

      1
      T1158

      Defense Evasion

      File Deletion

      2
      T1107

      Modify Registry

      1
      T1112

      File Permissions Modification

      1
      T1222

      Hidden Files and Directories

      1
      T1158

      Impact

      Inhibit System Recovery

      2
      T1490

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Usbstor:bin
      • C:\Users\Admin\AppData\Roaming\Usbstor:bin
      • C:\Windows\SysWOW64\Usbstor.exe
      • \Users\Admin\AppData\Roaming\Usbstor
      • \Users\Admin\AppData\Roaming\Usbstor
      • memory/1092-4-0x0000000000000000-mapping.dmp
      • memory/1448-2-0x0000000000000000-mapping.dmp
      • memory/1568-14-0x0000000000000000-mapping.dmp
      • memory/1580-13-0x0000000000000000-mapping.dmp
      • memory/1588-12-0x0000000000000000-mapping.dmp
      • memory/1604-11-0x0000000000000000-mapping.dmp
      • memory/1768-9-0x0000000000000000-mapping.dmp
      • memory/1788-10-0x0000000000000000-mapping.dmp
      • memory/1812-6-0x0000000000000000-mapping.dmp
      • memory/1832-8-0x0000000000000000-mapping.dmp