Analysis
-
max time kernel
57s -
max time network
150s -
platform
windows10_x64 -
resource
win10 -
submitted
17-09-2020 15:28
General
-
Target
8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe
-
Size
1.7MB
-
MD5
3f4181968baaf480a628d522c14cee75
-
SHA1
0cfbe9d8a205fa528c00c96253ff309ab666ee90
-
SHA256
8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351
-
SHA512
319332107b9da31aaa752dc75d5291c80668c204be2b6f0a3d31d4a48428bdccd5dcc7787678eb003fbb3d61af5245ea0d8c87b343cbaf77877e5f0c49e69db4
Malware Config
Signatures
-
Ouroboros/Zeropadypt
Ransomware family based on open-source CryptoWire.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Executes dropped EXE 2 IoCs
-
Modifies Windows Firewall 1 TTPs
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
-
Suspicious Office macro 2 IoCs
Office document equipped with macros.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops desktop.ini file(s) 64 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
NTFS ADS 3 IoCs
-
Runs net.exe
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe"C:\Users\Admin\AppData\Local\Temp\8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe"C:\Users\Admin\AppData\Local\Temp\._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exe"2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLWriter3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop SQLWriter4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLWriter5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLBrowser3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop SQLBrowser4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLBrowser5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQLSERVER3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop MSSQLSERVER4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$CONTOSO14⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$CONTOSO15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSDTC3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop MSDTC4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSDTC5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop SQLSERVERAGENT4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLSERVERAGENT5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop MSSQLSERVER3⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLSERVER4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net stop vds3⤵
-
C:\Windows\SysWOW64\net.exenet stop vds4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop vds5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set currentprofile state off4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable3⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable4⤵
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Synaptics\Synaptics.exeMD5
06fdd27742bc4dcb30bc348fa0c24041
SHA1532db4b18a787d4d6a7e48f0b43c51210312f82b
SHA2565aaa3a31d1683ad8d80d2abeb978dbfa35ccfec75e26e41388bd2df69aff07b8
SHA512ba567237981d4ad6fe5c1dd4ea21602b3398125fefe33858c0da719ac7bdab4d99e0be09c993a6bbafda5448855a9a8bbaa4ea148a356e5c5b71de54d6c5c722
-
C:\ProgramData\Synaptics\Synaptics.exeMD5
06fdd27742bc4dcb30bc348fa0c24041
SHA1532db4b18a787d4d6a7e48f0b43c51210312f82b
SHA2565aaa3a31d1683ad8d80d2abeb978dbfa35ccfec75e26e41388bd2df69aff07b8
SHA512ba567237981d4ad6fe5c1dd4ea21602b3398125fefe33858c0da719ac7bdab4d99e0be09c993a6bbafda5448855a9a8bbaa4ea148a356e5c5b71de54d6c5c722
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868MD5
9087054ddf41bb06ad4b758843aa8589
SHA1bb4c277416af7baf2fcd41b3ca56b6e05f593d3f
SHA2569dc36612a80e50606781ad919565fea023f4f90159b08aab46737c04c6d45993
SHA512119e53ca990bc51ae02970d4d299985bb8d6c06fbb42199c2c7e6dfbe38f3787f913e5c1599236098047040c1bcb7eafe1ce08ca4f50f2a62f0e55ce2fec69ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868MD5
bb2b01e21fb4fe81670baceb3b07aa5f
SHA1a3f625a27f371d53db5614ffa17c76ad9ca0d494
SHA256d693afdb04b13d18037cf094c4e6d3dfc17080efd896eabeb14c2cacd2c8d28b
SHA512756248a2244943f220d9198edee1cc61cc8456e9b8835dc377ec41fada4a7cb82580276eb488b7a17f23eda27fd3b3316a76a8369b06317a7f9c44e6e3dfb115
-
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\48906990-CA26-4C05-878A-21B2DFCC337EMD5
f7d413892dc951b5b459d6cff3814fac
SHA1b7fafc89644ba6f1943b2ed550b517f06feeaa97
SHA25629ce550bf8492a9712d0b8385729bd5f72f75cda2747c11f9d9815629997aecb
SHA512f32f5e3df3a18f970fe06c3ff0164ec95c6e4b507e94eb40a254cf61ae16e605b4424a99d0ee58325bd12cc8cd98b4bb230a310d6889571785f38fd3e3bbc283
-
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xmlMD5
0209dee92826be2ed0e5d84bc987acc4
SHA16a1e0fab679a984a6bf5829906e2bb3d35e848b2
SHA256d1b32a92159cba6b23228b7d8b63df866ad07daf24907b1307a4385b974787d5
SHA512b945804d17887d693bb7ff00f85728bff0b63bf3408d974824a3657ac39b52d0e14768a8a18339d6eeb7376c18df71088af122cda6ae573e26df6b63df92cdbc
-
C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\TenantInfo.xmlMD5
0f8eb2423d2bf6cb5b8bdb44cb170ca3
SHA1242755226012b4449a49b45491c0b1538ebf6410
SHA256385347c0cbacdd3c61d2635fbd390e0095a008fd75eeb23af2f14f975c083944
SHA512a9f23a42340b83a2f59df930d7563e8abd669b9f0955562cd3c2872e2e081f26d6d8b26357972b6d0423af05b2392bddbb46da769788e77fd169b3264ff53886
-
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.dbMD5
f138a66469c10d5761c6cbb36f2163c3
SHA1eea136206474280549586923b7a4a3c6d5db1e25
SHA256c712d6c7a60f170a0c6c5ec768d962c58b1f59a2d417e98c7c528a037c427ab6
SHA5129d25f943b6137dd2981ee75d57baf3a9e0ee27eea2df19591d580f02ec8520d837b8e419a8b1eb7197614a3c6d8793c56ebc848c38295ada23c31273daa302d9
-
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db-walMD5
a4ca6195666643428a7d5e06ea839673
SHA1c50af1ef249481c56065ef68ccade0895b4cae03
SHA2564101a6665b5e096bb1b88f46ca0d695dc8e504a619bf638b07a958cc3f67c162
SHA5124fd3b4c771ad41ed6089a2021bbb741aee802ac637befa79fbd9027b4b0667aa576545b958625e65b1d8b8a601d7f92e7bb644440514234729f78465bba74f96
-
C:\Users\Admin\AppData\Local\Temp\._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exeMD5
934984b11e6690c10e7ad5bf1f0cf274
SHA15c826f0bca1460508b0a3db4b0e5f9fbd7c2104f
SHA25695a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e
SHA5124cc96789b2c6a40b94d7dc5d3ed11876dc643172211114ee588bfc0988f00cc3508d0d1e5d39a08e29b003f12429ba46fa07ac58402d6838b7263a640b20f13e
-
C:\Users\Admin\AppData\Local\Temp\._cache_8df97f59144a4f3d55572156abd94b750a1a6ebbb5d1a08c001b5e1f4a1ce351.exeMD5
934984b11e6690c10e7ad5bf1f0cf274
SHA15c826f0bca1460508b0a3db4b0e5f9fbd7c2104f
SHA25695a0cdecb7f933ee8768acf2c04718c3d02c10d10e580bd85786252c1091706e
SHA5124cc96789b2c6a40b94d7dc5d3ed11876dc643172211114ee588bfc0988f00cc3508d0d1e5d39a08e29b003f12429ba46fa07ac58402d6838b7263a640b20f13e
-
C:\Users\Admin\AppData\Local\Temp\.sesMD5
0c1a4f1d9973e6bd7b5ff4c658da3823
SHA10963ea618550a5dbd44e6b21bda1d7e93dbd4ee1
SHA2565207847962982933b83c61454d5acf0fd01a0e4ed50b1998962c0368c7f53c3e
SHA512997cfdffbad0e1fd8c541c29bdca319e3ab56bfb6df32a4ffd00501a8b223fb0e4cce53bda22a865da193b5ebae900c310df9640f70a8ca886f2737fcde8f664
-
C:\Users\Admin\AppData\Local\Temp\I3exZfok.xlsmMD5
e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
C:\Users\Admin\Documents\AddSave.xlsmMD5
e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
C:\Users\Admin\Documents\~$cache1MD5
06fdd27742bc4dcb30bc348fa0c24041
SHA1532db4b18a787d4d6a7e48f0b43c51210312f82b
SHA2565aaa3a31d1683ad8d80d2abeb978dbfa35ccfec75e26e41388bd2df69aff07b8
SHA512ba567237981d4ad6fe5c1dd4ea21602b3398125fefe33858c0da719ac7bdab4d99e0be09c993a6bbafda5448855a9a8bbaa4ea148a356e5c5b71de54d6c5c722
-
memory/636-19-0x0000000000000000-mapping.dmp
-
memory/648-29-0x0000000000000000-mapping.dmp
-
memory/948-4-0x0000000000000000-mapping.dmp
-
memory/1032-53-0x00000000014D0000-0x00000000014D1000-memory.dmpFilesize
4KB
-
memory/1032-51-0x00000000014D0000-0x00000000014D1000-memory.dmpFilesize
4KB
-
memory/1032-43-0x00000000014D0000-0x00000000014D1000-memory.dmpFilesize
4KB
-
memory/1032-44-0x0000000001CD0000-0x0000000001CD1000-memory.dmpFilesize
4KB
-
memory/1032-49-0x00000000014D0000-0x00000000014D1000-memory.dmpFilesize
4KB
-
memory/1032-50-0x0000000001CD0000-0x0000000001CD1000-memory.dmpFilesize
4KB
-
memory/1032-45-0x00000000014D0000-0x00000000014D1000-memory.dmpFilesize
4KB
-
memory/1032-47-0x00000000014D0000-0x00000000014D1000-memory.dmpFilesize
4KB
-
memory/1032-54-0x0000000001CD0000-0x0000000001CD1000-memory.dmpFilesize
4KB
-
memory/1032-46-0x0000000001CD0000-0x0000000001CD1000-memory.dmpFilesize
4KB
-
memory/1032-0-0x0000000000000000-mapping.dmp
-
memory/1092-25-0x0000000000000000-mapping.dmp
-
memory/1120-17-0x0000000000000000-mapping.dmp
-
memory/1184-18-0x0000000000000000-mapping.dmp
-
memory/1232-24-0x0000000000000000-mapping.dmp
-
memory/1236-26-0x0000000000000000-mapping.dmp
-
memory/1460-3-0x0000000000000000-mapping.dmp
-
memory/1668-30-0x0000000000000000-mapping.dmp
-
memory/2100-28-0x0000000000000000-mapping.dmp
-
memory/2160-7-0x0000000000000000-mapping.dmp
-
memory/2164-20-0x0000000000000000-mapping.dmp
-
memory/2184-35-0x0000000000000000-mapping.dmp
-
memory/2208-32-0x0000000000000000-mapping.dmp
-
memory/2356-8-0x0000000000000000-mapping.dmp
-
memory/2516-27-0x0000000000000000-mapping.dmp
-
memory/2564-15-0x0000000000000000-mapping.dmp
-
memory/2644-40-0x0000019ECDAA0000-0x0000019ECDAA4000-memory.dmpFilesize
16KB
-
memory/2644-37-0x0000019ECDAA0000-0x0000019ECDAA4000-memory.dmpFilesize
16KB
-
memory/2644-21-0x00007FFD040F0000-0x00007FFD047B6000-memory.dmpFilesize
6.8MB
-
memory/2672-22-0x0000000000000000-mapping.dmp
-
memory/2976-34-0x0000000000000000-mapping.dmp
-
memory/3008-16-0x0000000000000000-mapping.dmp
-
memory/3112-13-0x0000000000000000-mapping.dmp
-
memory/3244-11-0x0000000000000000-mapping.dmp
-
memory/3524-42-0x0000000000000000-mapping.dmp
-
memory/3736-14-0x0000000000000000-mapping.dmp
-
memory/3800-41-0x0000000000000000-mapping.dmp
-
memory/3804-23-0x0000000000000000-mapping.dmp
-
memory/3856-33-0x0000000000000000-mapping.dmp
-
memory/3952-12-0x0000000000000000-mapping.dmp
-
memory/3996-31-0x0000000000000000-mapping.dmp
-
memory/4016-10-0x0000000000000000-mapping.dmp
-
memory/4076-9-0x0000000000000000-mapping.dmp