Analysis
-
max time kernel
116s -
max time network
126s -
platform
windows7_x64 -
resource
win7 -
submitted
13-07-2020 13:56
Static task
static1
Behavioral task
behavioral1
Sample
1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
Resource
win7
Behavioral task
behavioral2
Sample
1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
Resource
win10v200430
General
-
Target
1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
-
Size
4.6MB
-
MD5
7d9c6313b2e412f0db4380b279eb4fed
-
SHA1
0675b3958e7eef4090775f665d8201837f167f01
-
SHA256
1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593
-
SHA512
ddaa21b661f448442df6556dec57429636e7aa6fa9ce4f098ac218cc702b301903c7bf254b9aee732a90561402b420d977be6bb7940bf49aa55e0e5f9991075e
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\HOW TO RESTORE YOUR FILES.TXT
Signatures
-
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.execmd.execmd.exedescription pid process target process PID 900 wrote to memory of 800 900 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe cmd.exe PID 900 wrote to memory of 800 900 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe cmd.exe PID 900 wrote to memory of 800 900 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe cmd.exe PID 800 wrote to memory of 1096 800 cmd.exe sc.exe PID 800 wrote to memory of 1096 800 cmd.exe sc.exe PID 800 wrote to memory of 1096 800 cmd.exe sc.exe PID 800 wrote to memory of 1080 800 cmd.exe findstr.exe PID 800 wrote to memory of 1080 800 cmd.exe findstr.exe PID 800 wrote to memory of 1080 800 cmd.exe findstr.exe PID 900 wrote to memory of 1516 900 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe cmd.exe PID 900 wrote to memory of 1516 900 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe cmd.exe PID 900 wrote to memory of 1516 900 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe cmd.exe PID 900 wrote to memory of 1904 900 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe cmd.exe PID 900 wrote to memory of 1904 900 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe cmd.exe PID 900 wrote to memory of 1904 900 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe cmd.exe PID 1904 wrote to memory of 1204 1904 cmd.exe vssadmin.exe PID 1904 wrote to memory of 1204 1904 cmd.exe vssadmin.exe PID 1904 wrote to memory of 1204 1904 cmd.exe vssadmin.exe PID 900 wrote to memory of 2020 900 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe cmd.exe PID 900 wrote to memory of 2020 900 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe cmd.exe PID 900 wrote to memory of 2020 900 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe cmd.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1952 vssvc.exe Token: SeRestorePrivilege 1952 vssvc.exe Token: SeAuditPrivilege 1952 vssvc.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1204 vssadmin.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Drops file in Program Files directory 14817 IoCs
Processes:
1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107148.WMF.tkoinprz 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif.tkoinprz 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\vlc.mo 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\BillingStatement.xltx.tkoinprz 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_BR\HOW TO RESTORE YOUR FILES.TXT 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Funafuti 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00985_.WMF.tkoinprz 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GR8GALRY.GRA.tkoinprz 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt.tkoinprz 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00152_.WMF 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR33F.GIF.tkoinprz 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\Access\Faculty.accdt 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\83.0.4103.106\MEIPreload\preloaded_data.pb.tkoinprz 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\bg_Earthy.gif 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDisableUpArrow.jpg 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MEDIA\HAMMER.WAV 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\J0115875.GIF 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\HOW TO RESTORE YOUR FILES.TXT 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Godthab 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BS00438_.WMF 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0213243.WMF.tkoinprz 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGWEBSBR.XML.tkoinprz 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18182_.WMF 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR21F.GIF 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_underline.gif 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\BRCHUR11.POC 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341738.JPG.tkoinprz 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html.tkoinprz 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.zh_CN_5.5.0.165303.jar 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_ja_4.4.0.v20140623020002.jar 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO00191_.WMF.tkoinprz 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PARNT_06.MID.tkoinprz 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143743.GIF 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\MedianLetter.Dotx 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\Document Themes 14\Horizon.thmx 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Costa_Rica 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Halifax.tkoinprz 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0187837.WMF 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH03014_.GIF.tkoinprz 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0152590.WMF 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TN00330_.WMF 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\CERT.DPV 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-dialogs.xml.tkoinprz 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Buenos_Aires.tkoinprz 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\BL00148_.WMF.tkoinprz 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0105328.WMF 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File created C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\HOW TO RESTORE YOUR FILES.TXT 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_zh_4.4.0.v20140623020002.jar 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_zh_CN.jar 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert.css 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File created C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\HOW TO RESTORE YOUR FILES.TXT 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00564_.WMF.tkoinprz 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SO02025_.WMF.tkoinprz 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\Sounds\Things\SPLASH.WAV 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF.tkoinprz 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Mawson.tkoinprz 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBlue.png.tkoinprz 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0151041.WMF.tkoinprz 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\TR00494_.WMF.tkoinprz 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\HOW TO RESTORE YOUR FILES.TXT 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms_3.6.100.v20140422-1825.jar.tkoinprz 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File opened for modification C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14830_.GIF.tkoinprz 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops startup file 2 IoCs
Processes:
1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO RESTORE YOUR FILES.TXT 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\HOW TO RESTORE YOUR FILES.TXT 1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe"C:\Users\Admin\AppData\Local\Temp\1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593.exe"1⤵
- Suspicious use of WriteProcessMemory
- Drops file in Program Files directory
- Drops startup file
PID:900 -
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\kboivghkklyakv.bat2⤵
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\system32\sc.exeSC QUERY3⤵PID:1096
-
C:\Windows\system32\findstr.exeFINDSTR SERVICE_NAME3⤵PID:1080
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\gpdryggcrrf.bat2⤵PID:1516
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\vselkhqibxgiuulwmnqw.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1204 -
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\twdlhcvrrrxia.bat2⤵PID:2020
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:1952