Analysis

  • max time kernel
    128s
  • max time network
    39s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    25-06-2020 05:30

General

  • Target

    bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8.exe

  • Size

    60KB

  • MD5

    0ed2ca539a01cdb86c88a9a1604b2005

  • SHA1

    4fed7eae00bfa21938e49f33b7c6794fd7d0750c

  • SHA256

    bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8

  • SHA512

    34dad101cd7c5f9ff2267674d224986b9274e0e17d9ae665ca1af4ffa57408106238b1e248045465ab17c72a4b92473ab3714aefb705d95f9725a4251379c7e2

Malware Config

Signatures

  • Modifies service 2 TTPs 5 IoCs
  • Views/modifies file attributes 1 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
  • Possible privilege escalation attempt 2 IoCs
  • NTFS ADS 1 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8.exe
    "C:\Users\Admin\AppData\Local\Temp\bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8.exe"
    1⤵
    • NTFS ADS
    • Suspicious use of WriteProcessMemory
    PID:1484
    • C:\Users\Admin\AppData\Roaming\Resources:bin
      C:\Users\Admin\AppData\Roaming\Resources:bin -r
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1548
      • C:\Windows\system32\vssadmin.exe
        C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • Interacts with shadow copies
        PID:1664
      • C:\Windows\SysWOW64\takeown.exe
        C:\Windows\system32\takeown.exe /F C:\Windows\system32\Resources.exe
        3⤵
        • Modifies file permissions
        • Possible privilege escalation attempt
        PID:2604
      • C:\Windows\SysWOW64\icacls.exe
        C:\Windows\system32\icacls.exe C:\Windows\system32\Resources.exe /reset
        3⤵
        • Modifies file permissions
        • Possible privilege escalation attempt
        PID:2824
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Roaming\Resources" & del "C:\Users\Admin\AppData\Roaming\Resources"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1672
        • C:\Windows\SysWOW64\choice.exe
          choice /t 10 /d y
          4⤵
            PID:3776
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h "C:\Users\Admin\AppData\Roaming\Resources"
            4⤵
            • Views/modifies file attributes
            PID:260
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8.exe" & del "C:\Users\Admin\AppData\Local\Temp\bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3484
        • C:\Windows\SysWOW64\choice.exe
          choice /t 10 /d y
          3⤵
            PID:980
          • C:\Windows\SysWOW64\attrib.exe
            attrib -h "C:\Users\Admin\AppData\Local\Temp\bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8.exe"
            3⤵
            • Views/modifies file attributes
            PID:280
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Modifies service
        • Suspicious use of AdjustPrivilegeToken
        PID:1516
      • C:\Windows\SysWOW64\Resources.exe
        C:\Windows\SysWOW64\Resources.exe -s
        1⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3812
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c choice /t 10 /d y & attrib -h "C:\Windows\SysWOW64\Resources.exe" & del "C:\Windows\SysWOW64\Resources.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3980
          • C:\Windows\SysWOW64\choice.exe
            choice /t 10 /d y
            3⤵
              PID:984
            • C:\Windows\SysWOW64\attrib.exe
              attrib -h "C:\Windows\SysWOW64\Resources.exe"
              3⤵
              • Views/modifies file attributes
              • Drops file in System32 directory
              PID:2188

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Persistence

        Modify Existing Service

        1
        T1031

        Hidden Files and Directories

        1
        T1158

        Defense Evasion

        Modify Registry

        1
        T1112

        Hidden Files and Directories

        1
        T1158

        File Permissions Modification

        1
        T1222

        File Deletion

        2
        T1107

        Impact

        Inhibit System Recovery

        2
        T1490

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Resources:bin
        • C:\Users\Admin\AppData\Roaming\Resources:bin
        • C:\Windows\SysWOW64\Resources.exe
        • C:\Windows\SysWOW64\Resources.exe
        • memory/260-15-0x0000000000000000-mapping.dmp
        • memory/280-16-0x0000000000000000-mapping.dmp
        • memory/980-13-0x0000000000000000-mapping.dmp
        • memory/984-9-0x0000000000000000-mapping.dmp
        • memory/1548-0-0x0000000000000000-mapping.dmp
        • memory/1664-3-0x0000000000000000-mapping.dmp
        • memory/1672-10-0x0000000000000000-mapping.dmp
        • memory/2188-14-0x0000000000000000-mapping.dmp
        • memory/2604-4-0x0000000000000000-mapping.dmp
        • memory/2824-6-0x0000000000000000-mapping.dmp
        • memory/3484-11-0x0000000000000000-mapping.dmp
        • memory/3776-12-0x0000000000000000-mapping.dmp
        • memory/3980-8-0x0000000000000000-mapping.dmp