Analysis
-
max time kernel
281s -
max time network
282s -
platform
windows10_x64 -
resource
win10 -
submitted
13-07-2020 16:52
Static task
static1
Behavioral task
behavioral1
Sample
887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.exe
Resource
win10
General
-
Target
887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.exe
-
Size
1.1MB
-
MD5
6b20ef8fb494cc6e455220356de298d0
-
SHA1
763d356d30e81d1cd15f6bc6a31f96181edb0b8f
-
SHA256
887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d
-
SHA512
ef53b73a911a608439bf929fa66a66fbf015ed274735b91c1d3b08128b14d6514d5514157e541441b9de0827d068c8f514cfd24a3a52fecb2d09764c4fb3311a
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.exeUtilities:binUtilities.execmd.execmd.execmd.exedescription pid process target process PID 716 wrote to memory of 336 716 887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.exe Utilities:bin PID 716 wrote to memory of 336 716 887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.exe Utilities:bin PID 716 wrote to memory of 336 716 887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.exe Utilities:bin PID 336 wrote to memory of 364 336 Utilities:bin vssadmin.exe PID 336 wrote to memory of 364 336 Utilities:bin vssadmin.exe PID 336 wrote to memory of 3912 336 Utilities:bin takeown.exe PID 336 wrote to memory of 3912 336 Utilities:bin takeown.exe PID 336 wrote to memory of 3912 336 Utilities:bin takeown.exe PID 336 wrote to memory of 3752 336 Utilities:bin icacls.exe PID 336 wrote to memory of 3752 336 Utilities:bin icacls.exe PID 336 wrote to memory of 3752 336 Utilities:bin icacls.exe PID 960 wrote to memory of 3508 960 Utilities.exe cmd.exe PID 960 wrote to memory of 3508 960 Utilities.exe cmd.exe PID 960 wrote to memory of 3508 960 Utilities.exe cmd.exe PID 3508 wrote to memory of 2504 3508 cmd.exe choice.exe PID 3508 wrote to memory of 2504 3508 cmd.exe choice.exe PID 3508 wrote to memory of 2504 3508 cmd.exe choice.exe PID 336 wrote to memory of 2844 336 Utilities:bin cmd.exe PID 336 wrote to memory of 2844 336 Utilities:bin cmd.exe PID 336 wrote to memory of 2844 336 Utilities:bin cmd.exe PID 716 wrote to memory of 1532 716 887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.exe cmd.exe PID 716 wrote to memory of 1532 716 887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.exe cmd.exe PID 716 wrote to memory of 1532 716 887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.exe cmd.exe PID 2844 wrote to memory of 3652 2844 cmd.exe choice.exe PID 2844 wrote to memory of 3652 2844 cmd.exe choice.exe PID 2844 wrote to memory of 3652 2844 cmd.exe choice.exe PID 1532 wrote to memory of 980 1532 cmd.exe choice.exe PID 1532 wrote to memory of 980 1532 cmd.exe choice.exe PID 1532 wrote to memory of 980 1532 cmd.exe choice.exe PID 3508 wrote to memory of 236 3508 cmd.exe attrib.exe PID 3508 wrote to memory of 236 3508 cmd.exe attrib.exe PID 3508 wrote to memory of 236 3508 cmd.exe attrib.exe PID 2844 wrote to memory of 256 2844 cmd.exe attrib.exe PID 2844 wrote to memory of 256 2844 cmd.exe attrib.exe PID 2844 wrote to memory of 256 2844 cmd.exe attrib.exe PID 1532 wrote to memory of 3676 1532 cmd.exe attrib.exe PID 1532 wrote to memory of 3676 1532 cmd.exe attrib.exe PID 1532 wrote to memory of 3676 1532 cmd.exe attrib.exe -
WastedLocker
Ransomware family seen in the wild since May 2020.
-
Drops file in System32 directory 2 IoCs
Processes:
Utilities:binattrib.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Utilities.exe Utilities:bin File opened for modification C:\Windows\SysWOW64\Utilities.exe attrib.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
NTFS ADS 1 IoCs
Processes:
887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Utilities:bin 887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.exe -
Executes dropped EXE 2 IoCs
Processes:
Utilities:binUtilities.exepid process 336 Utilities:bin 960 Utilities.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 3728 vssvc.exe Token: SeRestorePrivilege 3728 vssvc.exe Token: SeAuditPrivilege 3728 vssvc.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
icacls.exetakeown.exepid process 3752 icacls.exe 3912 takeown.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 3912 takeown.exe 3752 icacls.exe -
Views/modifies file attributes 1 TTPs 3 IoCs
Processes:
attrib.exeattrib.exeattrib.exepid process 236 attrib.exe 256 attrib.exe 3676 attrib.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 364 vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.exe"C:\Users\Admin\AppData\Local\Temp\887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.exe"1⤵
- Suspicious use of WriteProcessMemory
- NTFS ADS
-
C:\Users\Admin\AppData\Roaming\Utilities:binC:\Users\Admin\AppData\Roaming\Utilities:bin -r2⤵
- Suspicious use of WriteProcessMemory
- Drops file in System32 directory
- Executes dropped EXE
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\takeown.exeC:\Windows\system32\takeown.exe /F C:\Windows\system32\Utilities.exe3⤵
- Modifies file permissions
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\icacls.exeC:\Windows\system32\icacls.exe C:\Windows\system32\Utilities.exe /reset3⤵
- Modifies file permissions
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Roaming\Utilities" & del "C:\Users\Admin\AppData\Roaming\Utilities"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y4⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Roaming\Utilities"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.exe" & del "C:\Users\Admin\AppData\Local\Temp\887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Local\Temp\887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.exe"3⤵
- Views/modifies file attributes
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Utilities.exeC:\Windows\SysWOW64\Utilities.exe -s1⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Windows\SysWOW64\Utilities.exe" & del "C:\Windows\SysWOW64\Utilities.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Windows\SysWOW64\Utilities.exe"3⤵
- Drops file in System32 directory
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Utilities:bin
-
C:\Users\Admin\AppData\Roaming\Utilities:bin
-
C:\Windows\SysWOW64\Utilities.exe
-
C:\Windows\SysWOW64\Utilities.exe
-
memory/236-14-0x0000000000000000-mapping.dmp
-
memory/256-15-0x0000000000000000-mapping.dmp
-
memory/336-0-0x0000000000000000-mapping.dmp
-
memory/364-3-0x0000000000000000-mapping.dmp
-
memory/980-13-0x0000000000000000-mapping.dmp
-
memory/1532-11-0x0000000000000000-mapping.dmp
-
memory/2504-9-0x0000000000000000-mapping.dmp
-
memory/2844-10-0x0000000000000000-mapping.dmp
-
memory/3508-8-0x0000000000000000-mapping.dmp
-
memory/3652-12-0x0000000000000000-mapping.dmp
-
memory/3676-16-0x0000000000000000-mapping.dmp
-
memory/3752-6-0x0000000000000000-mapping.dmp
-
memory/3912-4-0x0000000000000000-mapping.dmp