Analysis
-
max time kernel
143s -
max time network
98s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
27-07-2020 10:55
Static task
static1
Behavioral task
behavioral1
Sample
905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe
Resource
win10v200722
General
-
Target
905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe
-
Size
1.2MB
-
MD5
2cc4534b0dd0e1c8d5b89644274a10c1
-
SHA1
735ee2c15c0b7172f65d39f0fd33b9186ee69653
-
SHA256
905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a
-
SHA512
a842b2d171aa6efa1b391d5d0f84663e78021b485555e2bf10a5e589d8652057f5abbd88e1a5ec628b714692ec5d63c3172894aa7846d5897e87d99dad67e2b8
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
WastedLocker
Ransomware family seen in the wild since May 2020.
-
Drops file in System32 directory 2 IoCs
Processes:
Secure:binattrib.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Secure.exe Secure:bin File opened for modification C:\Windows\SysWOW64\Secure.exe attrib.exe -
NTFS ADS 1 IoCs
Processes:
905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Secure:bin 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 644 vssadmin.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exeSecure:binSecure.execmd.execmd.execmd.exedescription pid process target process PID 2584 wrote to memory of 492 2584 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe Secure:bin PID 2584 wrote to memory of 492 2584 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe Secure:bin PID 2584 wrote to memory of 492 2584 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe Secure:bin PID 492 wrote to memory of 644 492 Secure:bin vssadmin.exe PID 492 wrote to memory of 644 492 Secure:bin vssadmin.exe PID 492 wrote to memory of 1344 492 Secure:bin takeown.exe PID 492 wrote to memory of 1344 492 Secure:bin takeown.exe PID 492 wrote to memory of 1344 492 Secure:bin takeown.exe PID 492 wrote to memory of 1504 492 Secure:bin icacls.exe PID 492 wrote to memory of 1504 492 Secure:bin icacls.exe PID 492 wrote to memory of 1504 492 Secure:bin icacls.exe PID 1760 wrote to memory of 2300 1760 Secure.exe cmd.exe PID 1760 wrote to memory of 2300 1760 Secure.exe cmd.exe PID 1760 wrote to memory of 2300 1760 Secure.exe cmd.exe PID 2300 wrote to memory of 2612 2300 cmd.exe choice.exe PID 2300 wrote to memory of 2612 2300 cmd.exe choice.exe PID 2300 wrote to memory of 2612 2300 cmd.exe choice.exe PID 492 wrote to memory of 2660 492 Secure:bin cmd.exe PID 492 wrote to memory of 2660 492 Secure:bin cmd.exe PID 492 wrote to memory of 2660 492 Secure:bin cmd.exe PID 2584 wrote to memory of 2676 2584 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe cmd.exe PID 2584 wrote to memory of 2676 2584 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe cmd.exe PID 2584 wrote to memory of 2676 2584 905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe cmd.exe PID 2660 wrote to memory of 3924 2660 cmd.exe choice.exe PID 2660 wrote to memory of 3924 2660 cmd.exe choice.exe PID 2660 wrote to memory of 3924 2660 cmd.exe choice.exe PID 2676 wrote to memory of 2204 2676 cmd.exe choice.exe PID 2676 wrote to memory of 2204 2676 cmd.exe choice.exe PID 2676 wrote to memory of 2204 2676 cmd.exe choice.exe PID 2300 wrote to memory of 3824 2300 cmd.exe attrib.exe PID 2300 wrote to memory of 3824 2300 cmd.exe attrib.exe PID 2300 wrote to memory of 3824 2300 cmd.exe attrib.exe PID 2660 wrote to memory of 576 2660 cmd.exe attrib.exe PID 2660 wrote to memory of 576 2660 cmd.exe attrib.exe PID 2660 wrote to memory of 576 2660 cmd.exe attrib.exe PID 2676 wrote to memory of 472 2676 cmd.exe attrib.exe PID 2676 wrote to memory of 472 2676 cmd.exe attrib.exe PID 2676 wrote to memory of 472 2676 cmd.exe attrib.exe -
Executes dropped EXE 2 IoCs
Processes:
Secure:binSecure.exepid process 492 Secure:bin 1760 Secure.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1004 vssvc.exe Token: SeRestorePrivilege 1004 vssvc.exe Token: SeAuditPrivilege 1004 vssvc.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 1344 takeown.exe 1504 icacls.exe -
Modifies extensions of user files 15 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
Secure.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\AssertClear.png.garminwasted Secure.exe File created C:\Users\Admin\Pictures\InitializeSave.crw.garminwasted_info Secure.exe File renamed C:\Users\Admin\Pictures\AssertClear.png => C:\Users\Admin\Pictures\AssertClear.png.garminwasted Secure.exe File opened for modification C:\Users\Admin\Pictures\ConnectEnable.raw.garminwasted Secure.exe File renamed C:\Users\Admin\Pictures\ConnectEnable.raw => C:\Users\Admin\Pictures\ConnectEnable.raw.garminwasted Secure.exe File renamed C:\Users\Admin\Pictures\UnpublishUnregister.tif => C:\Users\Admin\Pictures\UnpublishUnregister.tif.garminwasted Secure.exe File opened for modification C:\Users\Admin\Pictures\UnpublishUnregister.tif.garminwasted Secure.exe File created C:\Users\Admin\Pictures\AssertClear.png.garminwasted_info Secure.exe File created C:\Users\Admin\Pictures\ConnectEnable.raw.garminwasted_info Secure.exe File created C:\Users\Admin\Pictures\UnpublishUnregister.tif.garminwasted_info Secure.exe File created C:\Users\Admin\Pictures\PingLimit.tiff.garminwasted_info Secure.exe File opened for modification C:\Users\Admin\Pictures\PingLimit.tiff.garminwasted Secure.exe File renamed C:\Users\Admin\Pictures\PingLimit.tiff => C:\Users\Admin\Pictures\PingLimit.tiff.garminwasted Secure.exe File renamed C:\Users\Admin\Pictures\InitializeSave.crw => C:\Users\Admin\Pictures\InitializeSave.crw.garminwasted Secure.exe File opened for modification C:\Users\Admin\Pictures\InitializeSave.crw.garminwasted Secure.exe -
Views/modifies file attributes 1 TTPs 3 IoCs
Processes:
attrib.exeattrib.exeattrib.exepid process 3824 attrib.exe 576 attrib.exe 472 attrib.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 1344 takeown.exe 1504 icacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe"C:\Users\Admin\AppData\Local\Temp\905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe"1⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Secure:binC:\Users\Admin\AppData\Roaming\Secure:bin -r2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\takeown.exeC:\Windows\system32\takeown.exe /F C:\Windows\system32\Secure.exe3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exeC:\Windows\system32\icacls.exe C:\Windows\system32\Secure.exe /reset3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Roaming\Secure" & del "C:\Users\Admin\AppData\Roaming\Secure"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y4⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Roaming\Secure"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe" & del "C:\Users\Admin\AppData\Local\Temp\905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Local\Temp\905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a.bin.exe"3⤵
- Views/modifies file attributes
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
-
C:\Windows\SysWOW64\Secure.exeC:\Windows\SysWOW64\Secure.exe -s1⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Modifies extensions of user files
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Windows\SysWOW64\Secure.exe" & del "C:\Windows\SysWOW64\Secure.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Windows\SysWOW64\Secure.exe"3⤵
- Drops file in System32 directory
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Secure:bin
-
C:\Users\Admin\AppData\Roaming\Secure:bin
-
C:\Windows\SysWOW64\Secure.exe
-
C:\Windows\SysWOW64\Secure.exe
-
memory/472-16-0x0000000000000000-mapping.dmp
-
memory/492-0-0x0000000000000000-mapping.dmp
-
memory/576-15-0x0000000000000000-mapping.dmp
-
memory/644-3-0x0000000000000000-mapping.dmp
-
memory/1344-4-0x0000000000000000-mapping.dmp
-
memory/1504-6-0x0000000000000000-mapping.dmp
-
memory/2204-13-0x0000000000000000-mapping.dmp
-
memory/2300-8-0x0000000000000000-mapping.dmp
-
memory/2612-9-0x0000000000000000-mapping.dmp
-
memory/2660-10-0x0000000000000000-mapping.dmp
-
memory/2676-11-0x0000000000000000-mapping.dmp
-
memory/3824-14-0x0000000000000000-mapping.dmp
-
memory/3924-12-0x0000000000000000-mapping.dmp