Analysis
-
max time kernel
30s -
platform
windows7_x64 -
resource
win7 -
submitted
26-07-2020 21:04
Static task
static1
Behavioral task
behavioral1
Sample
905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.exe
Resource
win7
Errors
General
-
Target
905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.exe
-
Size
1.2MB
-
MD5
2cc4534b0dd0e1c8d5b89644274a10c1
-
SHA1
735ee2c15c0b7172f65d39f0fd33b9186ee69653
-
SHA256
905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a
-
SHA512
a842b2d171aa6efa1b391d5d0f84663e78021b485555e2bf10a5e589d8652057f5abbd88e1a5ec628b714692ec5d63c3172894aa7846d5897e87d99dad67e2b8
Malware Config
Signatures
-
Views/modifies file attributes 1 TTPs 3 IoCs
Processes:
attrib.exeattrib.exeattrib.exepid process 1948 attrib.exe 1944 attrib.exe 1968 attrib.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 1512 takeown.exe 1388 icacls.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 1512 takeown.exe 1388 icacls.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1532 cmd.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1316 vssadmin.exe -
WastedLocker
Ransomware family seen in the wild since May 2020.
-
NTFS ADS 1 IoCs
Processes:
905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Remote:bin 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Loads dropped DLL 2 IoCs
Processes:
905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.exepid process 1124 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.exe 1124 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.exe -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.exeRemote:binRemote.execmd.execmd.execmd.exedescription pid process target process PID 1124 wrote to memory of 1272 1124 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.exe Remote:bin PID 1124 wrote to memory of 1272 1124 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.exe Remote:bin PID 1124 wrote to memory of 1272 1124 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.exe Remote:bin PID 1124 wrote to memory of 1272 1124 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.exe Remote:bin PID 1272 wrote to memory of 1316 1272 Remote:bin vssadmin.exe PID 1272 wrote to memory of 1316 1272 Remote:bin vssadmin.exe PID 1272 wrote to memory of 1316 1272 Remote:bin vssadmin.exe PID 1272 wrote to memory of 1316 1272 Remote:bin vssadmin.exe PID 1272 wrote to memory of 1512 1272 Remote:bin takeown.exe PID 1272 wrote to memory of 1512 1272 Remote:bin takeown.exe PID 1272 wrote to memory of 1512 1272 Remote:bin takeown.exe PID 1272 wrote to memory of 1512 1272 Remote:bin takeown.exe PID 1272 wrote to memory of 1388 1272 Remote:bin icacls.exe PID 1272 wrote to memory of 1388 1272 Remote:bin icacls.exe PID 1272 wrote to memory of 1388 1272 Remote:bin icacls.exe PID 1272 wrote to memory of 1388 1272 Remote:bin icacls.exe PID 1380 wrote to memory of 1856 1380 Remote.exe cmd.exe PID 1380 wrote to memory of 1856 1380 Remote.exe cmd.exe PID 1380 wrote to memory of 1856 1380 Remote.exe cmd.exe PID 1380 wrote to memory of 1856 1380 Remote.exe cmd.exe PID 1856 wrote to memory of 1580 1856 cmd.exe choice.exe PID 1856 wrote to memory of 1580 1856 cmd.exe choice.exe PID 1856 wrote to memory of 1580 1856 cmd.exe choice.exe PID 1856 wrote to memory of 1580 1856 cmd.exe choice.exe PID 1272 wrote to memory of 1608 1272 Remote:bin cmd.exe PID 1272 wrote to memory of 1608 1272 Remote:bin cmd.exe PID 1272 wrote to memory of 1608 1272 Remote:bin cmd.exe PID 1272 wrote to memory of 1608 1272 Remote:bin cmd.exe PID 1124 wrote to memory of 1532 1124 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.exe cmd.exe PID 1124 wrote to memory of 1532 1124 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.exe cmd.exe PID 1124 wrote to memory of 1532 1124 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.exe cmd.exe PID 1124 wrote to memory of 1532 1124 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.exe cmd.exe PID 1608 wrote to memory of 1864 1608 cmd.exe choice.exe PID 1608 wrote to memory of 1864 1608 cmd.exe choice.exe PID 1608 wrote to memory of 1864 1608 cmd.exe choice.exe PID 1608 wrote to memory of 1864 1608 cmd.exe choice.exe PID 1532 wrote to memory of 1900 1532 cmd.exe choice.exe PID 1532 wrote to memory of 1900 1532 cmd.exe choice.exe PID 1532 wrote to memory of 1900 1532 cmd.exe choice.exe PID 1532 wrote to memory of 1900 1532 cmd.exe choice.exe PID 1856 wrote to memory of 1968 1856 cmd.exe attrib.exe PID 1856 wrote to memory of 1968 1856 cmd.exe attrib.exe PID 1856 wrote to memory of 1968 1856 cmd.exe attrib.exe PID 1856 wrote to memory of 1968 1856 cmd.exe attrib.exe PID 1532 wrote to memory of 1948 1532 cmd.exe attrib.exe PID 1532 wrote to memory of 1948 1532 cmd.exe attrib.exe PID 1532 wrote to memory of 1948 1532 cmd.exe attrib.exe PID 1532 wrote to memory of 1948 1532 cmd.exe attrib.exe PID 1608 wrote to memory of 1944 1608 cmd.exe attrib.exe PID 1608 wrote to memory of 1944 1608 cmd.exe attrib.exe PID 1608 wrote to memory of 1944 1608 cmd.exe attrib.exe PID 1608 wrote to memory of 1944 1608 cmd.exe attrib.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1492 vssvc.exe Token: SeRestorePrivilege 1492 vssvc.exe Token: SeAuditPrivilege 1492 vssvc.exe -
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
Remote.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\WriteConvert.tiff.garminwasted Remote.exe File created C:\Users\Admin\Pictures\DebugApprove.png.garminwasted_info Remote.exe File renamed C:\Users\Admin\Pictures\DebugApprove.png => C:\Users\Admin\Pictures\DebugApprove.png.garminwasted Remote.exe File opened for modification C:\Users\Admin\Pictures\DebugApprove.png.garminwasted Remote.exe File opened for modification C:\Users\Admin\Pictures\MoveInitialize.png.garminwasted Remote.exe File renamed C:\Users\Admin\Pictures\SendSwitch.tiff => C:\Users\Admin\Pictures\SendSwitch.tiff.garminwasted Remote.exe File opened for modification C:\Users\Admin\Pictures\SendSwitch.tiff.garminwasted Remote.exe File renamed C:\Users\Admin\Pictures\WriteConvert.tiff => C:\Users\Admin\Pictures\WriteConvert.tiff.garminwasted Remote.exe File created C:\Users\Admin\Pictures\MoveInitialize.png.garminwasted_info Remote.exe File renamed C:\Users\Admin\Pictures\MoveInitialize.png => C:\Users\Admin\Pictures\MoveInitialize.png.garminwasted Remote.exe File created C:\Users\Admin\Pictures\SendSwitch.tiff.garminwasted_info Remote.exe File created C:\Users\Admin\Pictures\WriteConvert.tiff.garminwasted_info Remote.exe -
Executes dropped EXE 2 IoCs
Processes:
Remote:binRemote.exepid process 1272 Remote:bin 1380 Remote.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops file in System32 directory 2 IoCs
Processes:
Remote:binattrib.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Remote.exe Remote:bin File opened for modification C:\Windows\SysWOW64\Remote.exe attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.exe"C:\Users\Admin\AppData\Local\Temp\905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.exe"1⤵
- NTFS ADS
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Remote:binC:\Users\Admin\AppData\Roaming\Remote:bin -r2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\takeown.exeC:\Windows\system32\takeown.exe /F C:\Windows\system32\Remote.exe3⤵
- Modifies file permissions
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\icacls.exeC:\Windows\system32\icacls.exe C:\Windows\system32\Remote.exe /reset3⤵
- Modifies file permissions
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Roaming\Remote" & del "C:\Users\Admin\AppData\Roaming\Remote"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y4⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Roaming\Remote"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.exe" & del "C:\Users\Admin\AppData\Local\Temp\905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Local\Temp\905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.exe"3⤵
- Views/modifies file attributes
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Remote.exeC:\Windows\SysWOW64\Remote.exe -s1⤵
- Suspicious use of WriteProcessMemory
- Modifies extensions of user files
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Windows\SysWOW64\Remote.exe" & del "C:\Windows\SysWOW64\Remote.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Windows\SysWOW64\Remote.exe"3⤵
- Views/modifies file attributes
- Drops file in System32 directory
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Remote:bin
-
C:\Users\Admin\AppData\Roaming\Remote:bin
-
C:\Windows\SysWOW64\Remote.exe
-
C:\Windows\SysWOW64\Remote.exe
-
\Users\Admin\AppData\Roaming\Remote
-
\Users\Admin\AppData\Roaming\Remote
-
memory/284-31-0x0000000002810000-0x0000000002811000-memory.dmpFilesize
4KB
-
memory/284-20-0x0000000002810000-0x0000000002811000-memory.dmpFilesize
4KB
-
memory/284-19-0x0000000002810000-0x0000000002811000-memory.dmpFilesize
4KB
-
memory/284-29-0x0000000002810000-0x0000000002811000-memory.dmpFilesize
4KB
-
memory/1272-2-0x0000000000000000-mapping.dmp
-
memory/1316-4-0x0000000000000000-mapping.dmp
-
memory/1388-8-0x0000000000000000-mapping.dmp
-
memory/1512-6-0x0000000000000000-mapping.dmp
-
memory/1532-13-0x0000000000000000-mapping.dmp
-
memory/1580-11-0x0000000000000000-mapping.dmp
-
memory/1608-12-0x0000000000000000-mapping.dmp
-
memory/1856-10-0x0000000000000000-mapping.dmp
-
memory/1864-14-0x0000000000000000-mapping.dmp
-
memory/1900-15-0x0000000000000000-mapping.dmp
-
memory/1944-18-0x0000000000000000-mapping.dmp
-
memory/1948-17-0x0000000000000000-mapping.dmp
-
memory/1968-16-0x0000000000000000-mapping.dmp