Analysis
-
max time kernel
148s -
max time network
63s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
26-07-2020 07:45
Static task
static1
Behavioral task
behavioral1
Sample
Interfaces.bin.exe
Resource
win7
Behavioral task
behavioral2
Sample
Interfaces.bin.exe
Resource
win10v200722
General
-
Target
Interfaces.bin.exe
-
Size
1MB
-
MD5
2cc4534b0dd0e1c8d5b89644274a10c1
-
SHA1
735ee2c15c0b7172f65d39f0fd33b9186ee69653
-
SHA256
905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a
-
SHA512
a842b2d171aa6efa1b391d5d0f84663e78021b485555e2bf10a5e589d8652057f5abbd88e1a5ec628b714692ec5d63c3172894aa7846d5897e87d99dad67e2b8
Malware Config
Signatures
-
WastedLocker
Ransomware family seen in the wild since May 2020.
-
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
Machine.exedescription ioc process File created C:\Users\Admin\Pictures\ResolveGrant.raw.garminwasted_info Machine.exe File renamed C:\Users\Admin\Pictures\ResolveGrant.raw => C:\Users\Admin\Pictures\ResolveGrant.raw.garminwasted Machine.exe File created C:\Users\Admin\Pictures\SyncDismount.raw.garminwasted_info Machine.exe File renamed C:\Users\Admin\Pictures\SyncDismount.raw => C:\Users\Admin\Pictures\SyncDismount.raw.garminwasted Machine.exe File created C:\Users\Admin\Pictures\FormatMerge.png.garminwasted_info Machine.exe File created C:\Users\Admin\Pictures\GetBlock.crw.garminwasted_info Machine.exe File renamed C:\Users\Admin\Pictures\FormatMerge.png => C:\Users\Admin\Pictures\FormatMerge.png.garminwasted Machine.exe File opened for modification C:\Users\Admin\Pictures\ResolveGrant.raw.garminwasted Machine.exe File opened for modification C:\Users\Admin\Pictures\SyncDismount.raw.garminwasted Machine.exe File opened for modification C:\Users\Admin\Pictures\FormatMerge.png.garminwasted Machine.exe File renamed C:\Users\Admin\Pictures\GetBlock.crw => C:\Users\Admin\Pictures\GetBlock.crw.garminwasted Machine.exe File opened for modification C:\Users\Admin\Pictures\GetBlock.crw.garminwasted Machine.exe -
Views/modifies file attributes 1 TTPs 3 IoCs
Processes:
attrib.exeattrib.exeattrib.exepid process 2056 attrib.exe 3136 attrib.exe 3756 attrib.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 1272 takeown.exe 1564 icacls.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 388 vssvc.exe Token: SeRestorePrivilege 388 vssvc.exe Token: SeAuditPrivilege 388 vssvc.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 640 vssadmin.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 1272 takeown.exe 1564 icacls.exe -
NTFS ADS 1 IoCs
Processes:
Interfaces.bin.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Machine:bin Interfaces.bin.exe -
Drops file in System32 directory 2 IoCs
Processes:
attrib.exeMachine:bindescription ioc process File opened for modification C:\Windows\SysWOW64\Machine.exe attrib.exe File opened for modification C:\Windows\SysWOW64\Machine.exe Machine:bin -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
Interfaces.bin.exeMachine:binMachine.execmd.execmd.execmd.exedescription pid process target process PID 408 wrote to memory of 504 408 Interfaces.bin.exe Machine:bin PID 408 wrote to memory of 504 408 Interfaces.bin.exe Machine:bin PID 408 wrote to memory of 504 408 Interfaces.bin.exe Machine:bin PID 504 wrote to memory of 640 504 Machine:bin vssadmin.exe PID 504 wrote to memory of 640 504 Machine:bin vssadmin.exe PID 504 wrote to memory of 1272 504 Machine:bin takeown.exe PID 504 wrote to memory of 1272 504 Machine:bin takeown.exe PID 504 wrote to memory of 1272 504 Machine:bin takeown.exe PID 504 wrote to memory of 1564 504 Machine:bin icacls.exe PID 504 wrote to memory of 1564 504 Machine:bin icacls.exe PID 504 wrote to memory of 1564 504 Machine:bin icacls.exe PID 1780 wrote to memory of 2312 1780 Machine.exe cmd.exe PID 1780 wrote to memory of 2312 1780 Machine.exe cmd.exe PID 1780 wrote to memory of 2312 1780 Machine.exe cmd.exe PID 2312 wrote to memory of 2492 2312 cmd.exe choice.exe PID 2312 wrote to memory of 2492 2312 cmd.exe choice.exe PID 2312 wrote to memory of 2492 2312 cmd.exe choice.exe PID 504 wrote to memory of 2540 504 Machine:bin cmd.exe PID 504 wrote to memory of 2540 504 Machine:bin cmd.exe PID 504 wrote to memory of 2540 504 Machine:bin cmd.exe PID 408 wrote to memory of 2648 408 Interfaces.bin.exe cmd.exe PID 408 wrote to memory of 2648 408 Interfaces.bin.exe cmd.exe PID 408 wrote to memory of 2648 408 Interfaces.bin.exe cmd.exe PID 2540 wrote to memory of 4012 2540 cmd.exe choice.exe PID 2540 wrote to memory of 4012 2540 cmd.exe choice.exe PID 2540 wrote to memory of 4012 2540 cmd.exe choice.exe PID 2648 wrote to memory of 2460 2648 cmd.exe choice.exe PID 2648 wrote to memory of 2460 2648 cmd.exe choice.exe PID 2648 wrote to memory of 2460 2648 cmd.exe choice.exe PID 2312 wrote to memory of 2056 2312 cmd.exe attrib.exe PID 2312 wrote to memory of 2056 2312 cmd.exe attrib.exe PID 2312 wrote to memory of 2056 2312 cmd.exe attrib.exe PID 2540 wrote to memory of 3136 2540 cmd.exe attrib.exe PID 2540 wrote to memory of 3136 2540 cmd.exe attrib.exe PID 2540 wrote to memory of 3136 2540 cmd.exe attrib.exe PID 2648 wrote to memory of 3756 2648 cmd.exe attrib.exe PID 2648 wrote to memory of 3756 2648 cmd.exe attrib.exe PID 2648 wrote to memory of 3756 2648 cmd.exe attrib.exe -
Executes dropped EXE 2 IoCs
Processes:
Machine:binMachine.exepid process 504 Machine:bin 1780 Machine.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Interfaces.bin.exe"C:\Users\Admin\AppData\Local\Temp\Interfaces.bin.exe"
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Machine:binC:\Users\Admin\AppData\Roaming\Machine:bin -r
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
- Interacts with shadow copies
-
C:\Windows\SysWOW64\takeown.exeC:\Windows\system32\takeown.exe /F C:\Windows\system32\Machine.exe
- Modifies file permissions
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\icacls.exeC:\Windows\system32\icacls.exe C:\Windows\system32\Machine.exe /reset
- Modifies file permissions
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Roaming\Machine" & del "C:\Users\Admin\AppData\Roaming\Machine"
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Roaming\Machine"
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\Interfaces.bin.exe" & del "C:\Users\Admin\AppData\Local\Temp\Interfaces.bin.exe"
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Local\Temp\Interfaces.bin.exe"
- Views/modifies file attributes
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe
- Suspicious use of AdjustPrivilegeToken
- Modifies service
-
C:\Windows\SysWOW64\Machine.exeC:\Windows\SysWOW64\Machine.exe -s
- Modifies extensions of user files
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Windows\SysWOW64\Machine.exe" & del "C:\Windows\SysWOW64\Machine.exe"
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Windows\SysWOW64\Machine.exe"
- Views/modifies file attributes
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Machine:bin
-
C:\Users\Admin\AppData\Roaming\Machine:bin
-
C:\Windows\SysWOW64\Machine.exe
-
C:\Windows\SysWOW64\Machine.exe
-
memory/504-0-0x0000000000000000-mapping.dmp
-
memory/640-3-0x0000000000000000-mapping.dmp
-
memory/1272-4-0x0000000000000000-mapping.dmp
-
memory/1564-6-0x0000000000000000-mapping.dmp
-
memory/2056-14-0x0000000000000000-mapping.dmp
-
memory/2312-8-0x0000000000000000-mapping.dmp
-
memory/2460-13-0x0000000000000000-mapping.dmp
-
memory/2492-9-0x0000000000000000-mapping.dmp
-
memory/2540-10-0x0000000000000000-mapping.dmp
-
memory/2648-11-0x0000000000000000-mapping.dmp
-
memory/3136-15-0x0000000000000000-mapping.dmp
-
memory/3756-16-0x0000000000000000-mapping.dmp
-
memory/4012-12-0x0000000000000000-mapping.dmp