Analysis
-
max time kernel
59s -
max time network
147s -
platform
windows7_x64 -
resource
win7 -
submitted
17-09-2020 15:28
General
-
Target
8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
-
Size
1.7MB
-
MD5
3f4181968baaf480a628d522c14cee75
-
SHA1
0cfbe9d8a205fa528c00c96253ff309ab666ee90
-
SHA256
8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351
-
SHA512
319332107b9da31aaa752dc75d5291c80668c204be2b6f0a3d31d4a48428bdccd5dcc7787678eb003fbb3d61af5245ea0d8c87b343cbaf77877e5f0c49e69db4
Malware Config
Signatures
-
Ouroboros/Zeropadypt
Ransomware family based on open-source CryptoWire.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Executes dropped EXE 2 IoCs
-
Modifies Windows Firewall 1 TTPs
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
-
Suspicious Office macro 2 IoCs
Office document equipped with macros.
-
Drops startup file 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops desktop.ini file(s) 64 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe"C:\Users\Admin\AppData\Local\Temp\8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe"C:\Users\Admin\AppData\Local\Temp\._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe"2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLWriter3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop SQLWriter4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLWriter5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLBrowser3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop SQLBrowser4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLBrowser5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQLSERVER3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop MSSQLSERVER4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$CONTOSO14⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$CONTOSO15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSDTC3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop MSDTC4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSDTC5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT3⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLSERVERAGENT4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLSERVERAGENT5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQLSERVER3⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLSERVER4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop vds3⤵
-
C:\Windows\SysWOW64\net.exenet stop vds4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop vds5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set currentprofile state off4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable4⤵
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Synaptics\Synaptics.exeMD5
06fdd27742bc4dcb30bc348fa0c24041
SHA1532db4b18a787d4d6a7e48f0b43c51210312f82b
SHA2565aaa3a31d1683ad8d80d2abeb978dbfa35ccfec75e26e41388bd2df69aff07b8
SHA512ba567237981d4ad6fe5c1dd4ea21602b3398125fefe33858c0da719ac7bdab4d99e0be09c993a6bbafda5448855a9a8bbaa4ea148a356e5c5b71de54d6c5c722
-
C:\ProgramData\Synaptics\Synaptics.exeMD5
06fdd27742bc4dcb30bc348fa0c24041
SHA1532db4b18a787d4d6a7e48f0b43c51210312f82b
SHA2565aaa3a31d1683ad8d80d2abeb978dbfa35ccfec75e26e41388bd2df69aff07b8
SHA512ba567237981d4ad6fe5c1dd4ea21602b3398125fefe33858c0da719ac7bdab4d99e0be09c993a6bbafda5448855a9a8bbaa4ea148a356e5c5b71de54d6c5c722
-
C:\Users\Admin\AppData\Local\Temp\._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exeMD5
934984b11e6690c10e7ad5bf1f0cf274
SHA15c826f0bca1460508b0a3db4b0e5f9fbd7c2104f
SHA25695a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e
SHA5124cc96789b2c6a40b94d7dc5d3ed11876dc643172211114ee588bfc0988f00cc3508d0d1e5d39a08e29b003f12429ba46fa07ac58402d6838b7263a640b20f13e
-
C:\Users\Admin\AppData\Local\Temp\U9dyD1H2.xlsmMD5
e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
C:\Users\Admin\Documents\MergeDeny.xlsmMD5
e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
C:\Users\Admin\Documents\~$cache1MD5
06fdd27742bc4dcb30bc348fa0c24041
SHA1532db4b18a787d4d6a7e48f0b43c51210312f82b
SHA2565aaa3a31d1683ad8d80d2abeb978dbfa35ccfec75e26e41388bd2df69aff07b8
SHA512ba567237981d4ad6fe5c1dd4ea21602b3398125fefe33858c0da719ac7bdab4d99e0be09c993a6bbafda5448855a9a8bbaa4ea148a356e5c5b71de54d6c5c722
-
\ProgramData\Synaptics\Synaptics.exeMD5
06fdd27742bc4dcb30bc348fa0c24041
SHA1532db4b18a787d4d6a7e48f0b43c51210312f82b
SHA2565aaa3a31d1683ad8d80d2abeb978dbfa35ccfec75e26e41388bd2df69aff07b8
SHA512ba567237981d4ad6fe5c1dd4ea21602b3398125fefe33858c0da719ac7bdab4d99e0be09c993a6bbafda5448855a9a8bbaa4ea148a356e5c5b71de54d6c5c722
-
\ProgramData\Synaptics\Synaptics.exeMD5
06fdd27742bc4dcb30bc348fa0c24041
SHA1532db4b18a787d4d6a7e48f0b43c51210312f82b
SHA2565aaa3a31d1683ad8d80d2abeb978dbfa35ccfec75e26e41388bd2df69aff07b8
SHA512ba567237981d4ad6fe5c1dd4ea21602b3398125fefe33858c0da719ac7bdab4d99e0be09c993a6bbafda5448855a9a8bbaa4ea148a356e5c5b71de54d6c5c722
-
\Users\Admin\AppData\Local\Temp\._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exeMD5
934984b11e6690c10e7ad5bf1f0cf274
SHA15c826f0bca1460508b0a3db4b0e5f9fbd7c2104f
SHA25695a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e
SHA5124cc96789b2c6a40b94d7dc5d3ed11876dc643172211114ee588bfc0988f00cc3508d0d1e5d39a08e29b003f12429ba46fa07ac58402d6838b7263a640b20f13e
-
memory/384-20-0x0000000000000000-mapping.dmp
-
memory/560-26-0x0000000000000000-mapping.dmp
-
memory/580-21-0x0000000000000000-mapping.dmp
-
memory/688-22-0x0000000000000000-mapping.dmp
-
memory/828-28-0x0000000000000000-mapping.dmp
-
memory/936-29-0x0000000000000000-mapping.dmp
-
memory/952-61-0x000007FEF7D20000-0x000007FEF7F9A000-memory.dmpFilesize
2.5MB
-
memory/952-27-0x0000000000000000-mapping.dmp
-
memory/1064-37-0x0000000000000000-mapping.dmp
-
memory/1228-31-0x0000000000000000-mapping.dmp
-
memory/1312-4-0x0000000000000000-mapping.dmp
-
memory/1328-25-0x0000000000000000-mapping.dmp
-
memory/1364-3-0x0000000000000000-mapping.dmp
-
memory/1460-35-0x0000000000000000-mapping.dmp
-
memory/1504-23-0x0000000000000000-mapping.dmp
-
memory/1516-1-0x0000000000000000-mapping.dmp
-
memory/1516-45-0x0000000001250000-0x0000000001261000-memory.dmpFilesize
68KB
-
memory/1516-44-0x0000000001660000-0x0000000001671000-memory.dmpFilesize
68KB
-
memory/1516-43-0x0000000001250000-0x0000000001261000-memory.dmpFilesize
68KB
-
memory/1540-13-0x0000000000000000-mapping.dmp
-
memory/1584-11-0x0000000000000000-mapping.dmp
-
memory/1612-30-0x0000000006900000-0x0000000006904000-memory.dmpFilesize
16KB
-
memory/1612-34-0x0000000006900000-0x0000000006904000-memory.dmpFilesize
16KB
-
memory/1624-12-0x0000000000000000-mapping.dmp
-
memory/1628-41-0x0000000000000000-mapping.dmp
-
memory/1636-39-0x0000000000000000-mapping.dmp
-
memory/1716-10-0x0000000000000000-mapping.dmp
-
memory/1796-38-0x0000000000000000-mapping.dmp
-
memory/1816-7-0x0000000000000000-mapping.dmp
-
memory/1824-8-0x0000000000000000-mapping.dmp
-
memory/1848-40-0x0000000000000000-mapping.dmp
-
memory/1872-42-0x0000000000000000-mapping.dmp
-
memory/1880-16-0x0000000000000000-mapping.dmp
-
memory/1900-15-0x0000000000000000-mapping.dmp
-
memory/1908-14-0x0000000000000000-mapping.dmp
-
memory/1924-19-0x0000000000000000-mapping.dmp
-
memory/1952-18-0x0000000000000000-mapping.dmp
-
memory/1960-17-0x0000000000000000-mapping.dmp
-
memory/2024-33-0x0000000000000000-mapping.dmp