46dc49be65d7165e2a6009854a4f27f0088230199e61e0555cb1bd266535874a

Analysis

max time kernel
106s
max time network
122s
platform
windows10_x64
resource
win10
submitted
11-08-2020 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

foo/60121ea2ab380455f7e143cd9438443e.exe

Score

9^/10

evasion ransomware

Malware Config

Signatures

Clears Windows event logs 1 TTPs
evasion ransomware

Indicator Removal on Host
T1070
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 ipinfo.io
2 ipinfo.io
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.

flow	ioc
1	ipinfo.io
2	ipinfo.io

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

60121ea2ab380455f7e143cd9438443e.exe

pid	process
3860	60121ea2ab380455f7e143cd9438443e.exe
3860	60121ea2ab380455f7e143cd9438443e.exe
3860	60121ea2ab380455f7e143cd9438443e.exe
3860	60121ea2ab380455f7e143cd9438443e.exe
3860	60121ea2ab380455f7e143cd9438443e.exe
3860	60121ea2ab380455f7e143cd9438443e.exe
3860	60121ea2ab380455f7e143cd9438443e.exe
3860	60121ea2ab380455f7e143cd9438443e.exe
3860	60121ea2ab380455f7e143cd9438443e.exe
3860	60121ea2ab380455f7e143cd9438443e.exe
3860	60121ea2ab380455f7e143cd9438443e.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

60121ea2ab380455f7e143cd9438443e.exewevtutil.exewevtutil.exewevtutil.exe

description	pid	process
Token: SeDebugPrivilege	3860	60121ea2ab380455f7e143cd9438443e.exe
Token: SeSecurityPrivilege	3356	wevtutil.exe
Token: SeBackupPrivilege	3356	wevtutil.exe
Token: SeSecurityPrivilege	3188	wevtutil.exe
Token: SeBackupPrivilege	3188	wevtutil.exe
Token: SeSecurityPrivilege	3548	wevtutil.exe
Token: SeBackupPrivilege	3548	wevtutil.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

60121ea2ab380455f7e143cd9438443e.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 3860 wrote to memory of 3240	3860	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 3860 wrote to memory of 3240	3860	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 3860 wrote to memory of 3240	3860	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 3240 wrote to memory of 3356	3240	cmd.exe	wevtutil.exe
PID 3240 wrote to memory of 3356	3240	cmd.exe	wevtutil.exe
PID 3240 wrote to memory of 3356	3240	cmd.exe	wevtutil.exe
PID 3860 wrote to memory of 3364	3860	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 3860 wrote to memory of 3364	3860	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 3860 wrote to memory of 3364	3860	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 3364 wrote to memory of 3188	3364	cmd.exe	wevtutil.exe
PID 3364 wrote to memory of 3188	3364	cmd.exe	wevtutil.exe
PID 3364 wrote to memory of 3188	3364	cmd.exe	wevtutil.exe
PID 3860 wrote to memory of 1888	3860	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 3860 wrote to memory of 1888	3860	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 3860 wrote to memory of 1888	3860	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 1888 wrote to memory of 3548	1888	cmd.exe	wevtutil.exe
PID 1888 wrote to memory of 3548	1888	cmd.exe	wevtutil.exe
PID 1888 wrote to memory of 3548	1888	cmd.exe	wevtutil.exe
PID 3860 wrote to memory of 2456	3860	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 3860 wrote to memory of 2456	3860	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 3860 wrote to memory of 2456	3860	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 2456 wrote to memory of 68	2456	cmd.exe	sc.exe
PID 2456 wrote to memory of 68	2456	cmd.exe	sc.exe
PID 2456 wrote to memory of 68	2456	cmd.exe	sc.exe
PID 3860 wrote to memory of 796	3860	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 3860 wrote to memory of 796	3860	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe
PID 3860 wrote to memory of 796	3860	60121ea2ab380455f7e143cd9438443e.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\foo\60121ea2ab380455f7e143cd9438443e.exe
"C:\Users\Admin\AppData\Local\Temp\foo\60121ea2ab380455f7e143cd9438443e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C wevtutil.exe clear-log Application
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe clear-log Application
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3356
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C wevtutil.exe clear-log Security
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe clear-log Security
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3188
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C wevtutil.exe clear-log System
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe clear-log System
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3548
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C sc config eventlog start=disabled
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\SysWOW64\sc.exe
    sc config eventlog start=disabled
    3⤵
    PID:68
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" sc stop eventlog
  2⤵
  PID:796

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal on Host

T1070

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/68-7-0x0000000000000000-mapping.dmp

Download
memory/796-8-0x0000000000000000-mapping.dmp

Download
memory/1888-4-0x0000000000000000-mapping.dmp

Download
memory/2456-6-0x0000000000000000-mapping.dmp

Download
memory/3188-3-0x0000000000000000-mapping.dmp

Download
memory/3240-0-0x0000000000000000-mapping.dmp

Download
memory/3356-1-0x0000000000000000-mapping.dmp

Download
memory/3364-2-0x0000000000000000-mapping.dmp

Download
memory/3548-5-0x0000000000000000-mapping.dmp

Download