Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows7_x64 -
resource
win7 -
submitted
05-08-2020 20:59
Static task
static1
Behavioral task
behavioral1
Sample
2cc4534b0dd0e1c8d5b89644274a10c1.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2cc4534b0dd0e1c8d5b89644274a10c1.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
-
Target
2cc4534b0dd0e1c8d5b89644274a10c1.exe
-
Size
1.2MB
-
MD5
2cc4534b0dd0e1c8d5b89644274a10c1
-
SHA1
735ee2c15c0b7172f65d39f0fd33b9186ee69653
-
SHA256
905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a
-
SHA512
a842b2d171aa6efa1b391d5d0f84663e78021b485555e2bf10a5e589d8652057f5abbd88e1a5ec628b714692ec5d63c3172894aa7846d5897e87d99dad67e2b8
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1084 Remote:bin 1828 Remote.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Remote:bin 2cc4534b0dd0e1c8d5b89644274a10c1.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 1104 takeown.exe 1512 icacls.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1452 vssvc.exe Token: SeRestorePrivilege 1452 vssvc.exe Token: SeAuditPrivilege 1452 vssvc.exe -
WastedLocker
Ransomware family seen in the wild since May 2020.
-
Possible privilege escalation attempt 2 IoCs
pid Process 1104 takeown.exe 1512 icacls.exe -
Loads dropped DLL 2 IoCs
pid Process 1072 2cc4534b0dd0e1c8d5b89644274a10c1.exe 1072 2cc4534b0dd0e1c8d5b89644274a10c1.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 1072 wrote to memory of 1084 1072 2cc4534b0dd0e1c8d5b89644274a10c1.exe 24 PID 1072 wrote to memory of 1084 1072 2cc4534b0dd0e1c8d5b89644274a10c1.exe 24 PID 1072 wrote to memory of 1084 1072 2cc4534b0dd0e1c8d5b89644274a10c1.exe 24 PID 1072 wrote to memory of 1084 1072 2cc4534b0dd0e1c8d5b89644274a10c1.exe 24 PID 1084 wrote to memory of 612 1084 Remote:bin 25 PID 1084 wrote to memory of 612 1084 Remote:bin 25 PID 1084 wrote to memory of 612 1084 Remote:bin 25 PID 1084 wrote to memory of 612 1084 Remote:bin 25 PID 1084 wrote to memory of 1104 1084 Remote:bin 29 PID 1084 wrote to memory of 1104 1084 Remote:bin 29 PID 1084 wrote to memory of 1104 1084 Remote:bin 29 PID 1084 wrote to memory of 1104 1084 Remote:bin 29 PID 1084 wrote to memory of 1512 1084 Remote:bin 31 PID 1084 wrote to memory of 1512 1084 Remote:bin 31 PID 1084 wrote to memory of 1512 1084 Remote:bin 31 PID 1084 wrote to memory of 1512 1084 Remote:bin 31 PID 1828 wrote to memory of 1856 1828 Remote.exe 35 PID 1828 wrote to memory of 1856 1828 Remote.exe 35 PID 1828 wrote to memory of 1856 1828 Remote.exe 35 PID 1828 wrote to memory of 1856 1828 Remote.exe 35 PID 1856 wrote to memory of 1608 1856 cmd.exe 37 PID 1856 wrote to memory of 1608 1856 cmd.exe 37 PID 1856 wrote to memory of 1608 1856 cmd.exe 37 PID 1856 wrote to memory of 1608 1856 cmd.exe 37 PID 1084 wrote to memory of 1664 1084 Remote:bin 38 PID 1084 wrote to memory of 1664 1084 Remote:bin 38 PID 1084 wrote to memory of 1664 1084 Remote:bin 38 PID 1084 wrote to memory of 1664 1084 Remote:bin 38 PID 1072 wrote to memory of 1576 1072 2cc4534b0dd0e1c8d5b89644274a10c1.exe 40 PID 1072 wrote to memory of 1576 1072 2cc4534b0dd0e1c8d5b89644274a10c1.exe 40 PID 1072 wrote to memory of 1576 1072 2cc4534b0dd0e1c8d5b89644274a10c1.exe 40 PID 1072 wrote to memory of 1576 1072 2cc4534b0dd0e1c8d5b89644274a10c1.exe 40 PID 1664 wrote to memory of 1876 1664 cmd.exe 42 PID 1664 wrote to memory of 1876 1664 cmd.exe 42 PID 1664 wrote to memory of 1876 1664 cmd.exe 42 PID 1664 wrote to memory of 1876 1664 cmd.exe 42 PID 1576 wrote to memory of 1884 1576 cmd.exe 43 PID 1576 wrote to memory of 1884 1576 cmd.exe 43 PID 1576 wrote to memory of 1884 1576 cmd.exe 43 PID 1576 wrote to memory of 1884 1576 cmd.exe 43 PID 1856 wrote to memory of 1964 1856 cmd.exe 44 PID 1856 wrote to memory of 1964 1856 cmd.exe 44 PID 1856 wrote to memory of 1964 1856 cmd.exe 44 PID 1856 wrote to memory of 1964 1856 cmd.exe 44 PID 1664 wrote to memory of 1940 1664 cmd.exe 45 PID 1664 wrote to memory of 1940 1664 cmd.exe 45 PID 1664 wrote to memory of 1940 1664 cmd.exe 45 PID 1664 wrote to memory of 1940 1664 cmd.exe 45 PID 1576 wrote to memory of 1952 1576 cmd.exe 46 PID 1576 wrote to memory of 1952 1576 cmd.exe 46 PID 1576 wrote to memory of 1952 1576 cmd.exe 46 PID 1576 wrote to memory of 1952 1576 cmd.exe 46 -
Modifies service 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe -
Views/modifies file attributes 1 TTPs 3 IoCs
pid Process 1964 attrib.exe 1940 attrib.exe 1952 attrib.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 612 vssadmin.exe -
Deletes itself 1 IoCs
pid Process 1576 cmd.exe -
Modifies extensions of user files 15 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ResumeAssert.crw => C:\Users\Admin\Pictures\ResumeAssert.crw.garminwasted Remote.exe File opened for modification C:\Users\Admin\Pictures\EditExpand.png.garminwasted Remote.exe File opened for modification C:\Users\Admin\Pictures\InvokeConvert.tiff.garminwasted Remote.exe File created C:\Users\Admin\Pictures\ResumeAssert.crw.garminwasted_info Remote.exe File created C:\Users\Admin\Pictures\SwitchImport.png.garminwasted_info Remote.exe File created C:\Users\Admin\Pictures\EditExpand.png.garminwasted_info Remote.exe File renamed C:\Users\Admin\Pictures\InvokeConvert.tiff => C:\Users\Admin\Pictures\InvokeConvert.tiff.garminwasted Remote.exe File opened for modification C:\Users\Admin\Pictures\SwitchImport.png.garminwasted Remote.exe File renamed C:\Users\Admin\Pictures\EditExpand.png => C:\Users\Admin\Pictures\EditExpand.png.garminwasted Remote.exe File opened for modification C:\Users\Admin\Pictures\ResumeAssert.crw.garminwasted Remote.exe File opened for modification C:\Users\Admin\Pictures\DisableInitialize.crw.garminwasted Remote.exe File created C:\Users\Admin\Pictures\InvokeConvert.tiff.garminwasted_info Remote.exe File renamed C:\Users\Admin\Pictures\SwitchImport.png => C:\Users\Admin\Pictures\SwitchImport.png.garminwasted Remote.exe File created C:\Users\Admin\Pictures\DisableInitialize.crw.garminwasted_info Remote.exe File renamed C:\Users\Admin\Pictures\DisableInitialize.crw => C:\Users\Admin\Pictures\DisableInitialize.crw.garminwasted Remote.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Remote.exe Remote:bin File opened for modification C:\Windows\SysWOW64\Remote.exe attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cc4534b0dd0e1c8d5b89644274a10c1.exe"C:\Users\Admin\AppData\Local\Temp\2cc4534b0dd0e1c8d5b89644274a10c1.exe"1⤵
- NTFS ADS
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Roaming\Remote:binC:\Users\Admin\AppData\Roaming\Remote:bin -r2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Drops file in System32 directory
PID:1084 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:612
-
-
C:\Windows\SysWOW64\takeown.exeC:\Windows\system32\takeown.exe /F C:\Windows\system32\Remote.exe3⤵
- Modifies file permissions
- Possible privilege escalation attempt
PID:1104
-
-
C:\Windows\SysWOW64\icacls.exeC:\Windows\system32\icacls.exe C:\Windows\system32\Remote.exe /reset3⤵
- Modifies file permissions
- Possible privilege escalation attempt
PID:1512
-
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Roaming\Remote" & del "C:\Users\Admin\AppData\Roaming\Remote"3⤵
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y4⤵PID:1876
-
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Roaming\Remote"4⤵
- Views/modifies file attributes
PID:1940
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\2cc4534b0dd0e1c8d5b89644274a10c1.exe" & del "C:\Users\Admin\AppData\Local\Temp\2cc4534b0dd0e1c8d5b89644274a10c1.exe"2⤵
- Suspicious use of WriteProcessMemory
- Deletes itself
PID:1576 -
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵PID:1884
-
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Local\Temp\2cc4534b0dd0e1c8d5b89644274a10c1.exe"3⤵
- Views/modifies file attributes
PID:1952
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:1452
-
C:\Windows\SysWOW64\Remote.exeC:\Windows\SysWOW64\Remote.exe -s1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Modifies extensions of user files
PID:1828 -
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Windows\SysWOW64\Remote.exe" & del "C:\Windows\SysWOW64\Remote.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵PID:1608
-
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Windows\SysWOW64\Remote.exe"3⤵
- Views/modifies file attributes
- Drops file in System32 directory
PID:1964
-
-