Analysis
-
max time kernel
149s -
max time network
39s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
27-07-2020 10:55
Static task
static1
Behavioral task
behavioral1
Sample
905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe
Resource
win10v200722
General
-
Target
905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe
-
Size
1.2MB
-
MD5
2cc4534b0dd0e1c8d5b89644274a10c1
-
SHA1
735ee2c15c0b7172f65d39f0fd33b9186ee69653
-
SHA256
905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a
-
SHA512
a842b2d171aa6efa1b391d5d0f84663e78021b485555e2bf10a5e589d8652057f5abbd88e1a5ec628b714692ec5d63c3172894aa7846d5897e87d99dad67e2b8
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exeArbiter:binArbiter.execmd.execmd.execmd.exedescription pid process target process PID 1436 wrote to memory of 1504 1436 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe Arbiter:bin PID 1436 wrote to memory of 1504 1436 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe Arbiter:bin PID 1436 wrote to memory of 1504 1436 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe Arbiter:bin PID 1436 wrote to memory of 1504 1436 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe Arbiter:bin PID 1504 wrote to memory of 364 1504 Arbiter:bin vssadmin.exe PID 1504 wrote to memory of 364 1504 Arbiter:bin vssadmin.exe PID 1504 wrote to memory of 364 1504 Arbiter:bin vssadmin.exe PID 1504 wrote to memory of 364 1504 Arbiter:bin vssadmin.exe PID 1504 wrote to memory of 1272 1504 Arbiter:bin takeown.exe PID 1504 wrote to memory of 1272 1504 Arbiter:bin takeown.exe PID 1504 wrote to memory of 1272 1504 Arbiter:bin takeown.exe PID 1504 wrote to memory of 1272 1504 Arbiter:bin takeown.exe PID 1504 wrote to memory of 1832 1504 Arbiter:bin icacls.exe PID 1504 wrote to memory of 1832 1504 Arbiter:bin icacls.exe PID 1504 wrote to memory of 1832 1504 Arbiter:bin icacls.exe PID 1504 wrote to memory of 1832 1504 Arbiter:bin icacls.exe PID 1720 wrote to memory of 564 1720 Arbiter.exe cmd.exe PID 1720 wrote to memory of 564 1720 Arbiter.exe cmd.exe PID 1720 wrote to memory of 564 1720 Arbiter.exe cmd.exe PID 1720 wrote to memory of 564 1720 Arbiter.exe cmd.exe PID 564 wrote to memory of 956 564 cmd.exe choice.exe PID 564 wrote to memory of 956 564 cmd.exe choice.exe PID 564 wrote to memory of 956 564 cmd.exe choice.exe PID 564 wrote to memory of 956 564 cmd.exe choice.exe PID 1504 wrote to memory of 628 1504 Arbiter:bin cmd.exe PID 1504 wrote to memory of 628 1504 Arbiter:bin cmd.exe PID 1504 wrote to memory of 628 1504 Arbiter:bin cmd.exe PID 1504 wrote to memory of 628 1504 Arbiter:bin cmd.exe PID 1436 wrote to memory of 1892 1436 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe cmd.exe PID 1436 wrote to memory of 1892 1436 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe cmd.exe PID 1436 wrote to memory of 1892 1436 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe cmd.exe PID 1436 wrote to memory of 1892 1436 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe cmd.exe PID 628 wrote to memory of 1620 628 cmd.exe choice.exe PID 628 wrote to memory of 1620 628 cmd.exe choice.exe PID 628 wrote to memory of 1620 628 cmd.exe choice.exe PID 628 wrote to memory of 1620 628 cmd.exe choice.exe PID 1892 wrote to memory of 1604 1892 cmd.exe choice.exe PID 1892 wrote to memory of 1604 1892 cmd.exe choice.exe PID 1892 wrote to memory of 1604 1892 cmd.exe choice.exe PID 1892 wrote to memory of 1604 1892 cmd.exe choice.exe PID 564 wrote to memory of 1896 564 cmd.exe attrib.exe PID 564 wrote to memory of 1896 564 cmd.exe attrib.exe PID 564 wrote to memory of 1896 564 cmd.exe attrib.exe PID 564 wrote to memory of 1896 564 cmd.exe attrib.exe PID 628 wrote to memory of 2024 628 cmd.exe attrib.exe PID 628 wrote to memory of 2024 628 cmd.exe attrib.exe PID 628 wrote to memory of 2024 628 cmd.exe attrib.exe PID 628 wrote to memory of 2024 628 cmd.exe attrib.exe PID 1892 wrote to memory of 2008 1892 cmd.exe attrib.exe PID 1892 wrote to memory of 2008 1892 cmd.exe attrib.exe PID 1892 wrote to memory of 2008 1892 cmd.exe attrib.exe PID 1892 wrote to memory of 2008 1892 cmd.exe attrib.exe -
Executes dropped EXE 2 IoCs
Processes:
Arbiter:binArbiter.exepid process 1504 Arbiter:bin 1720 Arbiter.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1892 cmd.exe -
WastedLocker
Ransomware family seen in the wild since May 2020.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 364 vssadmin.exe -
Modifies extensions of user files 24 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
Arbiter.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\MoveMeasure.png.garminwasted Arbiter.exe File opened for modification C:\Users\Admin\Pictures\ResumeUninstall.png.garminwasted Arbiter.exe File created C:\Users\Admin\Pictures\SearchShow.png.garminwasted_info Arbiter.exe File created C:\Users\Admin\Pictures\StartComplete.tif.garminwasted_info Arbiter.exe File created C:\Users\Admin\Pictures\UnblockRedo.tif.garminwasted_info Arbiter.exe File created C:\Users\Admin\Pictures\MoveMeasure.png.garminwasted_info Arbiter.exe File renamed C:\Users\Admin\Pictures\MoveMeasure.png => C:\Users\Admin\Pictures\MoveMeasure.png.garminwasted Arbiter.exe File renamed C:\Users\Admin\Pictures\RepairConvert.raw => C:\Users\Admin\Pictures\RepairConvert.raw.garminwasted Arbiter.exe File renamed C:\Users\Admin\Pictures\PopJoin.tif => C:\Users\Admin\Pictures\PopJoin.tif.garminwasted Arbiter.exe File created C:\Users\Admin\Pictures\RepairConvert.raw.garminwasted_info Arbiter.exe File renamed C:\Users\Admin\Pictures\SearchShow.png => C:\Users\Admin\Pictures\SearchShow.png.garminwasted Arbiter.exe File opened for modification C:\Users\Admin\Pictures\SearchShow.png.garminwasted Arbiter.exe File renamed C:\Users\Admin\Pictures\StartComplete.tif => C:\Users\Admin\Pictures\StartComplete.tif.garminwasted Arbiter.exe File opened for modification C:\Users\Admin\Pictures\UnblockRedo.tif.garminwasted Arbiter.exe File opened for modification C:\Users\Admin\Pictures\PopJoin.tif.garminwasted Arbiter.exe File opened for modification C:\Users\Admin\Pictures\RepairConvert.raw.garminwasted Arbiter.exe File renamed C:\Users\Admin\Pictures\ResumeUninstall.png => C:\Users\Admin\Pictures\ResumeUninstall.png.garminwasted Arbiter.exe File opened for modification C:\Users\Admin\Pictures\StartComplete.tif.garminwasted Arbiter.exe File created C:\Users\Admin\Pictures\TestReset.tiff.garminwasted_info Arbiter.exe File renamed C:\Users\Admin\Pictures\TestReset.tiff => C:\Users\Admin\Pictures\TestReset.tiff.garminwasted Arbiter.exe File opened for modification C:\Users\Admin\Pictures\TestReset.tiff.garminwasted Arbiter.exe File renamed C:\Users\Admin\Pictures\UnblockRedo.tif => C:\Users\Admin\Pictures\UnblockRedo.tif.garminwasted Arbiter.exe File created C:\Users\Admin\Pictures\PopJoin.tif.garminwasted_info Arbiter.exe File created C:\Users\Admin\Pictures\ResumeUninstall.png.garminwasted_info Arbiter.exe -
Loads dropped DLL 2 IoCs
Processes:
905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exepid process 1436 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe 1436 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe -
Drops file in System32 directory 2 IoCs
Processes:
Arbiter:binattrib.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Arbiter.exe Arbiter:bin File opened for modification C:\Windows\SysWOW64\Arbiter.exe attrib.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
NTFS ADS 1 IoCs
Processes:
905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Arbiter:bin 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
icacls.exetakeown.exepid process 1832 icacls.exe 1272 takeown.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 752 vssvc.exe Token: SeRestorePrivilege 752 vssvc.exe Token: SeAuditPrivilege 752 vssvc.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 1272 takeown.exe 1832 icacls.exe -
Views/modifies file attributes 1 TTPs 3 IoCs
Processes:
attrib.exeattrib.exeattrib.exepid process 2008 attrib.exe 2024 attrib.exe 1896 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe"C:\Users\Admin\AppData\Local\Temp\905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe"1⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- NTFS ADS
-
C:\Users\Admin\AppData\Roaming\Arbiter:binC:\Users\Admin\AppData\Roaming\Arbiter:bin -r2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\takeown.exeC:\Windows\system32\takeown.exe /F C:\Windows\system32\Arbiter.exe3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exeC:\Windows\system32\icacls.exe C:\Windows\system32\Arbiter.exe /reset3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Roaming\Arbiter" & del "C:\Users\Admin\AppData\Roaming\Arbiter"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y4⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Roaming\Arbiter"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe" & del "C:\Users\Admin\AppData\Local\Temp\905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe"2⤵
- Suspicious use of WriteProcessMemory
- Deletes itself
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Local\Temp\905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe"3⤵
- Views/modifies file attributes
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Arbiter.exeC:\Windows\SysWOW64\Arbiter.exe -s1⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Modifies extensions of user files
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Windows\SysWOW64\Arbiter.exe" & del "C:\Windows\SysWOW64\Arbiter.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Windows\SysWOW64\Arbiter.exe"3⤵
- Drops file in System32 directory
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Arbiter:bin
-
C:\Users\Admin\AppData\Roaming\Arbiter:bin
-
C:\Windows\SysWOW64\Arbiter.exe
-
C:\Windows\SysWOW64\Arbiter.exe
-
\Users\Admin\AppData\Roaming\Arbiter
-
\Users\Admin\AppData\Roaming\Arbiter
-
memory/364-4-0x0000000000000000-mapping.dmp
-
memory/564-10-0x0000000000000000-mapping.dmp
-
memory/628-12-0x0000000000000000-mapping.dmp
-
memory/956-11-0x0000000000000000-mapping.dmp
-
memory/1272-6-0x0000000000000000-mapping.dmp
-
memory/1504-2-0x0000000000000000-mapping.dmp
-
memory/1604-15-0x0000000000000000-mapping.dmp
-
memory/1620-14-0x0000000000000000-mapping.dmp
-
memory/1832-8-0x0000000000000000-mapping.dmp
-
memory/1892-13-0x0000000000000000-mapping.dmp
-
memory/1896-16-0x0000000000000000-mapping.dmp
-
memory/2008-18-0x0000000000000000-mapping.dmp
-
memory/2024-17-0x0000000000000000-mapping.dmp