Analysis
-
max time kernel
47s -
max time network
55s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
24-08-2020 02:16
Static task
static1
Behavioral task
behavioral1
Sample
dc0266804bd2bfc83109152fef734d54f7a7d0c09487096a368ae45518d2ca13.bin.dll
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
dc0266804bd2bfc83109152fef734d54f7a7d0c09487096a368ae45518d2ca13.bin.dll
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
dc0266804bd2bfc83109152fef734d54f7a7d0c09487096a368ae45518d2ca13.bin.dll
-
Size
351KB
-
MD5
d52a2deeb2043e99d02fe19538991c38
-
SHA1
e9c7b92d3ff73b682ef23caf94ea0903ea095268
-
SHA256
dc0266804bd2bfc83109152fef734d54f7a7d0c09487096a368ae45518d2ca13
-
SHA512
efedb8fd9614e15ce563ae9768a7b895f928974a606faa8225fd03e5aa5eb65d0c509fd664f8ff6214b30b0f0ac9ad0080ce207eeef032badee2f87ec3472ab2
Score
10/10
Malware Config
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Blacklisted process makes network request 1 IoCs
flow pid Process 1 1596 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Modifies service 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1596 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1056 wmic.exe Token: SeSecurityPrivilege 1056 wmic.exe Token: SeTakeOwnershipPrivilege 1056 wmic.exe Token: SeLoadDriverPrivilege 1056 wmic.exe Token: SeSystemProfilePrivilege 1056 wmic.exe Token: SeSystemtimePrivilege 1056 wmic.exe Token: SeProfSingleProcessPrivilege 1056 wmic.exe Token: SeIncBasePriorityPrivilege 1056 wmic.exe Token: SeCreatePagefilePrivilege 1056 wmic.exe Token: SeBackupPrivilege 1056 wmic.exe Token: SeRestorePrivilege 1056 wmic.exe Token: SeShutdownPrivilege 1056 wmic.exe Token: SeDebugPrivilege 1056 wmic.exe Token: SeSystemEnvironmentPrivilege 1056 wmic.exe Token: SeRemoteShutdownPrivilege 1056 wmic.exe Token: SeUndockPrivilege 1056 wmic.exe Token: SeManageVolumePrivilege 1056 wmic.exe Token: 33 1056 wmic.exe Token: 34 1056 wmic.exe Token: 35 1056 wmic.exe Token: SeIncreaseQuotaPrivilege 1056 wmic.exe Token: SeSecurityPrivilege 1056 wmic.exe Token: SeTakeOwnershipPrivilege 1056 wmic.exe Token: SeLoadDriverPrivilege 1056 wmic.exe Token: SeSystemProfilePrivilege 1056 wmic.exe Token: SeSystemtimePrivilege 1056 wmic.exe Token: SeProfSingleProcessPrivilege 1056 wmic.exe Token: SeIncBasePriorityPrivilege 1056 wmic.exe Token: SeCreatePagefilePrivilege 1056 wmic.exe Token: SeBackupPrivilege 1056 wmic.exe Token: SeRestorePrivilege 1056 wmic.exe Token: SeShutdownPrivilege 1056 wmic.exe Token: SeDebugPrivilege 1056 wmic.exe Token: SeSystemEnvironmentPrivilege 1056 wmic.exe Token: SeRemoteShutdownPrivilege 1056 wmic.exe Token: SeUndockPrivilege 1056 wmic.exe Token: SeManageVolumePrivilege 1056 wmic.exe Token: 33 1056 wmic.exe Token: 34 1056 wmic.exe Token: 35 1056 wmic.exe Token: SeBackupPrivilege 1768 vssvc.exe Token: SeRestorePrivilege 1768 vssvc.exe Token: SeAuditPrivilege 1768 vssvc.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 112 wrote to memory of 1596 112 rundll32.exe 24 PID 112 wrote to memory of 1596 112 rundll32.exe 24 PID 112 wrote to memory of 1596 112 rundll32.exe 24 PID 112 wrote to memory of 1596 112 rundll32.exe 24 PID 112 wrote to memory of 1596 112 rundll32.exe 24 PID 112 wrote to memory of 1596 112 rundll32.exe 24 PID 112 wrote to memory of 1596 112 rundll32.exe 24 PID 1596 wrote to memory of 1056 1596 rundll32.exe 25 PID 1596 wrote to memory of 1056 1596 rundll32.exe 25 PID 1596 wrote to memory of 1056 1596 rundll32.exe 25 PID 1596 wrote to memory of 1056 1596 rundll32.exe 25
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dc0266804bd2bfc83109152fef734d54f7a7d0c09487096a368ae45518d2ca13.bin.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dc0266804bd2bfc83109152fef734d54f7a7d0c09487096a368ae45518d2ca13.bin.dll,#12⤵
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\system32\wbem\wmic.exe"C:\wj\..\Windows\vsh\auc\..\..\system32\vcf\xiq\..\..\wbem\er\..\wmic.exe" shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1056
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1768