Analysis
-
max time kernel
91s -
max time network
112s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
06-09-2020 16:58
Static task
static1
Behavioral task
behavioral1
Sample
Sample_5e63fe410b2e1300169afd83.bin.exe
Resource
win7
Behavioral task
behavioral2
Sample
Sample_5e63fe410b2e1300169afd83.bin.exe
Resource
win10v200722
General
-
Target
Sample_5e63fe410b2e1300169afd83.bin.exe
-
Size
94KB
-
MD5
993b73d6490bc5a7e23e02210b317247
-
SHA1
6fd314af34409e945504e166eb8cd88127c1070e
-
SHA256
de04d2402154f676f757cf1380671f396f3fc9f7dbb683d9461edd2718c4e09d
-
SHA512
417f55a066896695ce1b8d998767f706005d3d6f1792f2b86261a235034a6c3bb1deae6920857fbc710d22b833479b2cbeafd92735381f1cc357adcc8a74c55d
Malware Config
Extracted
C:\odt\BACAD-Readme.txt
mailto_hamlampampom
Extracted
C:\BACAD-Readme.txt
mailto_hamlampampom
Extracted
C:\Users\All Users\Microsoft\Search\Data\Applications\Windows\BACAD-Readme.txt
mailto_hamlampampom
Extracted
C:\Program Files\Java\jre1.8.0_66\BACAD-Readme.txt
mailto_hamlampampom
Extracted
C:\Program Files\7-Zip\Lang\BACAD-Readme.txt
mailto_hamlampampom
Signatures
-
MailTo (Hamlampampom Variant)
Ransomware family discovered in late 2019 with variants named based on contact emails.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
explorer.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\EnterSearch.tiff explorer.exe -
Deletes itself 1 IoCs
Processes:
explorer.exepid process 2312 explorer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bacad0e8 = "C:\\Program Files (x86)\\bacad0e8\\bacad0e8.exe" explorer.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Sample_5e63fe410b2e1300169afd83.bin.exedescription pid process target process PID 3648 set thread context of 2312 3648 Sample_5e63fe410b2e1300169afd83.bin.exe explorer.exe -
Drops file in Program Files directory 17082 IoCs
Processes:
explorer.exedescription ioc process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ro-ro\BACAD-Readme.txt explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Tiles\klondike.jpg explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe\Assets\Office\DeselectAll.scale-140.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemeCreation\Effects\effects_lobby_fireworks.jpg explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\pt-br\BACAD-Readme.txt explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\WideTile.scale-100.png explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\de-de\BACAD-Readme.txt explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\logo.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Speech\en-GB\tokens_enGB.xml explorer.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\BACAD-Readme.txt explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-16_altform-unplated.png explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\uk-ua\BACAD-Readme.txt explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.scale-125_contrast-black.png explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE\ICE.INF explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-48.png explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Acrobat_visual.svg explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ppd.xrm-ms explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\7739_36x36x32.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\bike.png explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailSmallTile.scale-125.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96_altform-unplated.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\201.png explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-explorer_ja.jar explorer.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\security\blacklist explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluNoInternetConnection_120x80.svg explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\WideTile.scale-200.png explorer.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\154.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-64_altform-unplated.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-256_altform-colorize.png explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\AddressBook.png explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_rename_18.svg explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\forms_received.gif explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemeCreation\Zoom_in.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\66.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\Workflow\Density_Hard.png explorer.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\CalculatorLargeTile.scale-125.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\StarClub\star.png explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-24.png explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaSansDemiBold.ttf explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-72_contrast-black.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\MedTile.scale-200.png explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxLargeTile.scale-125.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-20.png explorer.exe File created C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\BACAD-Readme.txt explorer.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\BACAD-Readme.txt explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-phn.xrm-ms explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GamePlayAssets\Localization\localized_IT-IT.respack explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\large\sunshine.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosLogoExtensions.targetsize-256.png explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\css\BACAD-Readme.txt explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarLargeTile.scale-200.png explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_zh_CN.jar explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-cn\ui-strings.js explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Office15\pkeyconfig-office.xrm-ms explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\tf_16x11.png explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeBadge.scale-150.png explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\Blog.dotx explorer.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubSmallTile.scale-125_contrast-high.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.DailyChallenges\Assets\PrizeHistory\awards_gold.png explorer.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\BACAD-Readme.txt explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-api-search.xml explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pt-br\BACAD-Readme.txt explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\notification.send.png explorer.exe -
Drops file in Windows directory 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat svchost.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 2708 vssadmin.exe 2740 vssadmin.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1" svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 7cef133b7f84d601 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0" svchost.exe -
Suspicious behavior: EnumeratesProcesses 18474 IoCs
Processes:
explorer.exeexplorer.exepid process 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2312 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe 2936 explorer.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
Sample_5e63fe410b2e1300169afd83.bin.exeexplorer.exepid process 3648 Sample_5e63fe410b2e1300169afd83.bin.exe 2312 explorer.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
svchost.exeexplorer.exevssvc.exeexplorer.exedescription pid process Token: SeShutdownPrivilege 1676 svchost.exe Token: SeCreatePagefilePrivilege 1676 svchost.exe Token: SeDebugPrivilege 2936 explorer.exe Token: SeBackupPrivilege 3832 vssvc.exe Token: SeRestorePrivilege 3832 vssvc.exe Token: SeAuditPrivilege 3832 vssvc.exe Token: SeDebugPrivilege 2312 explorer.exe Token: SeImpersonatePrivilege 2312 explorer.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Sample_5e63fe410b2e1300169afd83.bin.exeexplorer.exeexplorer.exedescription pid process target process PID 3648 wrote to memory of 2312 3648 Sample_5e63fe410b2e1300169afd83.bin.exe explorer.exe PID 3648 wrote to memory of 2312 3648 Sample_5e63fe410b2e1300169afd83.bin.exe explorer.exe PID 3648 wrote to memory of 2312 3648 Sample_5e63fe410b2e1300169afd83.bin.exe explorer.exe PID 2312 wrote to memory of 2936 2312 explorer.exe explorer.exe PID 2312 wrote to memory of 2936 2312 explorer.exe explorer.exe PID 2312 wrote to memory of 2936 2312 explorer.exe explorer.exe PID 2936 wrote to memory of 2708 2936 explorer.exe vssadmin.exe PID 2936 wrote to memory of 2708 2936 explorer.exe vssadmin.exe PID 2312 wrote to memory of 5728 2312 explorer.exe notepad.exe PID 2312 wrote to memory of 5728 2312 explorer.exe notepad.exe PID 2312 wrote to memory of 5728 2312 explorer.exe notepad.exe PID 2312 wrote to memory of 2740 2312 explorer.exe vssadmin.exe PID 2312 wrote to memory of 2740 2312 explorer.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sample_5e63fe410b2e1300169afd83.bin.exe"C:\Users\Admin\AppData\Local\Temp\Sample_5e63fe410b2e1300169afd83.bin.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"2⤵
- Modifies extensions of user files
- Deletes itself
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:2708
-
-
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\BACAD-Readme.txt"3⤵PID:5728
-
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2740
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1676
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:3832