Analysis
-
max time kernel
63s -
max time network
64s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
05-08-2020 20:59
Static task
static1
Behavioral task
behavioral1
Sample
2cc4534b0dd0e1c8d5b89644274a10c1.exe
Resource
win7
Behavioral task
behavioral2
Sample
2cc4534b0dd0e1c8d5b89644274a10c1.exe
Resource
win10v200722
General
-
Target
2cc4534b0dd0e1c8d5b89644274a10c1.exe
-
Size
1.2MB
-
MD5
2cc4534b0dd0e1c8d5b89644274a10c1
-
SHA1
735ee2c15c0b7172f65d39f0fd33b9186ee69653
-
SHA256
905ea119ad8d3e54cd228c458a1b5681abc1f35df782977a23812ec4efa0288a
-
SHA512
a842b2d171aa6efa1b391d5d0f84663e78021b485555e2bf10a5e589d8652057f5abbd88e1a5ec628b714692ec5d63c3172894aa7846d5897e87d99dad67e2b8
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 408 vssvc.exe Token: SeRestorePrivilege 408 vssvc.exe Token: SeAuditPrivilege 408 vssvc.exe -
NTFS ADS 1 IoCs
Processes:
2cc4534b0dd0e1c8d5b89644274a10c1.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\F79}:bin 2cc4534b0dd0e1c8d5b89644274a10c1.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 1000 takeown.exe 1140 icacls.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 3112 vssadmin.exe -
Drops file in System32 directory 2 IoCs
Processes:
F79}:binattrib.exedescription ioc process File opened for modification C:\Windows\SysWOW64\F79}.exe F79}:bin File opened for modification C:\Windows\SysWOW64\F79}.exe attrib.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 1000 takeown.exe 1140 icacls.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
2cc4534b0dd0e1c8d5b89644274a10c1.exeF79}:binF79}.execmd.execmd.execmd.exedescription pid process target process PID 3648 wrote to memory of 292 3648 2cc4534b0dd0e1c8d5b89644274a10c1.exe F79}:bin PID 3648 wrote to memory of 292 3648 2cc4534b0dd0e1c8d5b89644274a10c1.exe F79}:bin PID 3648 wrote to memory of 292 3648 2cc4534b0dd0e1c8d5b89644274a10c1.exe F79}:bin PID 292 wrote to memory of 3112 292 F79}:bin vssadmin.exe PID 292 wrote to memory of 3112 292 F79}:bin vssadmin.exe PID 292 wrote to memory of 1000 292 F79}:bin takeown.exe PID 292 wrote to memory of 1000 292 F79}:bin takeown.exe PID 292 wrote to memory of 1000 292 F79}:bin takeown.exe PID 292 wrote to memory of 1140 292 F79}:bin icacls.exe PID 292 wrote to memory of 1140 292 F79}:bin icacls.exe PID 292 wrote to memory of 1140 292 F79}:bin icacls.exe PID 1284 wrote to memory of 1716 1284 F79}.exe cmd.exe PID 1284 wrote to memory of 1716 1284 F79}.exe cmd.exe PID 1284 wrote to memory of 1716 1284 F79}.exe cmd.exe PID 1716 wrote to memory of 2024 1716 cmd.exe choice.exe PID 1716 wrote to memory of 2024 1716 cmd.exe choice.exe PID 1716 wrote to memory of 2024 1716 cmd.exe choice.exe PID 292 wrote to memory of 1968 292 F79}:bin cmd.exe PID 292 wrote to memory of 1968 292 F79}:bin cmd.exe PID 292 wrote to memory of 1968 292 F79}:bin cmd.exe PID 3648 wrote to memory of 2312 3648 2cc4534b0dd0e1c8d5b89644274a10c1.exe cmd.exe PID 3648 wrote to memory of 2312 3648 2cc4534b0dd0e1c8d5b89644274a10c1.exe cmd.exe PID 3648 wrote to memory of 2312 3648 2cc4534b0dd0e1c8d5b89644274a10c1.exe cmd.exe PID 1968 wrote to memory of 2936 1968 cmd.exe choice.exe PID 1968 wrote to memory of 2936 1968 cmd.exe choice.exe PID 1968 wrote to memory of 2936 1968 cmd.exe choice.exe PID 2312 wrote to memory of 2628 2312 cmd.exe choice.exe PID 2312 wrote to memory of 2628 2312 cmd.exe choice.exe PID 2312 wrote to memory of 2628 2312 cmd.exe choice.exe PID 1716 wrote to memory of 3864 1716 cmd.exe attrib.exe PID 1716 wrote to memory of 3864 1716 cmd.exe attrib.exe PID 1716 wrote to memory of 3864 1716 cmd.exe attrib.exe PID 1968 wrote to memory of 3928 1968 cmd.exe attrib.exe PID 1968 wrote to memory of 3928 1968 cmd.exe attrib.exe PID 1968 wrote to memory of 3928 1968 cmd.exe attrib.exe PID 2312 wrote to memory of 3800 2312 cmd.exe attrib.exe PID 2312 wrote to memory of 3800 2312 cmd.exe attrib.exe PID 2312 wrote to memory of 3800 2312 cmd.exe attrib.exe -
Executes dropped EXE 2 IoCs
Processes:
F79}:binF79}.exepid process 292 F79}:bin 1284 F79}.exe -
Views/modifies file attributes 1 TTPs 3 IoCs
Processes:
attrib.exeattrib.exeattrib.exepid process 3864 attrib.exe 3928 attrib.exe 3800 attrib.exe -
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
F79}.exedescription ioc process File created C:\Users\Admin\Pictures\ClearDeny.crw.garminwasted_info F79}.exe File renamed C:\Users\Admin\Pictures\ClearDeny.crw => C:\Users\Admin\Pictures\ClearDeny.crw.garminwasted F79}.exe File opened for modification C:\Users\Admin\Pictures\ClearDeny.crw.garminwasted F79}.exe File created C:\Users\Admin\Pictures\EnterSearch.tiff.garminwasted_info F79}.exe File renamed C:\Users\Admin\Pictures\EnterSearch.tiff => C:\Users\Admin\Pictures\EnterSearch.tiff.garminwasted F79}.exe File opened for modification C:\Users\Admin\Pictures\EnterSearch.tiff.garminwasted F79}.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cc4534b0dd0e1c8d5b89644274a10c1.exe"C:\Users\Admin\AppData\Local\Temp\2cc4534b0dd0e1c8d5b89644274a10c1.exe"1⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\F79}:binC:\Users\Admin\AppData\Roaming\F79}:bin -r2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\takeown.exeC:\Windows\system32\takeown.exe /F C:\Windows\system32\F79}.exe3⤵
- Modifies file permissions
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\icacls.exeC:\Windows\system32\icacls.exe C:\Windows\system32\F79}.exe /reset3⤵
- Modifies file permissions
- Possible privilege escalation attempt
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Roaming\F79}" & del "C:\Users\Admin\AppData\Roaming\F79}"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y4⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Roaming\F79}"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\2cc4534b0dd0e1c8d5b89644274a10c1.exe" & del "C:\Users\Admin\AppData\Local\Temp\2cc4534b0dd0e1c8d5b89644274a10c1.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Local\Temp\2cc4534b0dd0e1c8d5b89644274a10c1.exe"3⤵
- Views/modifies file attributes
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
-
C:\Windows\SysWOW64\F79}.exeC:\Windows\SysWOW64\F79}.exe -s1⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Modifies extensions of user files
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Windows\SysWOW64\F79}.exe" & del "C:\Windows\SysWOW64\F79}.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Windows\SysWOW64\F79}.exe"3⤵
- Drops file in System32 directory
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\F79}:bin
-
C:\Users\Admin\AppData\Roaming\F79}:bin
-
C:\Windows\SysWOW64\F79}.exe
-
C:\Windows\SysWOW64\F79}.exe
-
memory/292-0-0x0000000000000000-mapping.dmp
-
memory/1000-4-0x0000000000000000-mapping.dmp
-
memory/1140-6-0x0000000000000000-mapping.dmp
-
memory/1716-8-0x0000000000000000-mapping.dmp
-
memory/1968-10-0x0000000000000000-mapping.dmp
-
memory/2024-9-0x0000000000000000-mapping.dmp
-
memory/2312-11-0x0000000000000000-mapping.dmp
-
memory/2628-13-0x0000000000000000-mapping.dmp
-
memory/2936-12-0x0000000000000000-mapping.dmp
-
memory/3112-3-0x0000000000000000-mapping.dmp
-
memory/3800-16-0x0000000000000000-mapping.dmp
-
memory/3864-14-0x0000000000000000-mapping.dmp
-
memory/3928-15-0x0000000000000000-mapping.dmp