suncrypt | 3090bff3d16b0b150444c3bfb196229ba0ab0b6b826fa306803de0192beddb80

General

Target

3090bff3d16b0b150444c3bfb196229ba0ab0b6b826fa306803de0192beddb80.ps1
Size

1.4MB
MD5

d87fcd8d2bf450b0056a151e9a116f72
SHA1

48cb6bdbe092e5a90c778114b2dda43ce3221c9f
SHA256

3090bff3d16b0b150444c3bfb196229ba0ab0b6b826fa306803de0192beddb80
SHA512

61a636aca3d224dcd2ed29ca000cf0ecf88f51ffd7cb5182ea4599c9e889cb74b78824d93c7383457bd6d591506202527d44c6a15c93a9ab9cfc8230faddd04b

Score

10^/10

spyware ransomware suncrypt persistence

Malware Config

Signatures

SunCrypt Ransomware
Family which threatens to leak data alongside encrypting files. Has claimed to be collaborating with the Maze ransomware group.
ransomware suncrypt

Blacklisted process makes network request 1 IoCs

flow	pid	Process
5	1908	powershell.exe

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\ExportFind.png => C:\Users\Admin\Pictures\ExportFind.png.BDA78A15C625021C53DCF7488B84CC8CE81E577A6847D1340B9991E90FD6997C	powershell.exe
File renamed	C:\Users\Admin\Pictures\ReadSearch.raw => C:\Users\Admin\Pictures\ReadSearch.raw.483766DDC81B2D23779FB2C183AB74CFC47E4B2F9488836D0E0D5B90FEE8E27E	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\YOUR_FILES_ARE_ENCRYPTED.HTML	powershell.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	powershell.exe
File opened (read-only)	\??\W:	powershell.exe
File opened (read-only)	\??\Y:	powershell.exe
File opened (read-only)	\??\U:	powershell.exe
File opened (read-only)	\??\P:	powershell.exe
File opened (read-only)	\??\F:	powershell.exe
File opened (read-only)	\??\J:	powershell.exe
File opened (read-only)	\??\L:	powershell.exe
File opened (read-only)	\??\E:	powershell.exe
File opened (read-only)	\??\T:	powershell.exe
File opened (read-only)	\??\S:	powershell.exe
File opened (read-only)	\??\H:	powershell.exe
File opened (read-only)	\??\Z:	powershell.exe
File opened (read-only)	\??\R:	powershell.exe
File opened (read-only)	\??\O:	powershell.exe
File opened (read-only)	\??\K:	powershell.exe
File opened (read-only)	\??\B:	powershell.exe
File opened (read-only)	\??\N:	powershell.exe
File opened (read-only)	\??\I:	powershell.exe
File opened (read-only)	\??\G:	powershell.exe
File opened (read-only)	\??\X:	powershell.exe
File opened (read-only)	\??\V:	powershell.exe
File opened (read-only)	\??\M:	powershell.exe

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
836	powershell.exe
836	powershell.exe
1908	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	836	powershell.exe
Token: SeDebugPrivilege	1908	powershell.exe
Token: SeBackupPrivilege	1332	vssvc.exe
Token: SeRestorePrivilege	1332	vssvc.exe
Token: SeAuditPrivilege	1332	vssvc.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 1572	836	powershell.exe	29
PID 836 wrote to memory of 1572	836	powershell.exe	29
PID 836 wrote to memory of 1572	836	powershell.exe	29
PID 1572 wrote to memory of 1660	1572	csc.exe	30
PID 1572 wrote to memory of 1660	1572	csc.exe	30
PID 1572 wrote to memory of 1660	1572	csc.exe	30
PID 836 wrote to memory of 1908	836	powershell.exe	31
PID 836 wrote to memory of 1908	836	powershell.exe	31
PID 836 wrote to memory of 1908	836	powershell.exe	31
PID 836 wrote to memory of 1908	836	powershell.exe	31
PID 1908 wrote to memory of 1008	1908	powershell.exe	33
PID 1908 wrote to memory of 1008	1908	powershell.exe	33
PID 1908 wrote to memory of 1008	1908	powershell.exe	33
PID 1908 wrote to memory of 1008	1908	powershell.exe	33
PID 1008 wrote to memory of 396	1008	csc.exe	34
PID 1008 wrote to memory of 396	1008	csc.exe	34
PID 1008 wrote to memory of 396	1008	csc.exe	34
PID 1008 wrote to memory of 396	1008	csc.exe	34

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\3090bff3d16b0b150444c3bfb196229ba0ab0b6b826fa306803de0192beddb80.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4dtjuph3\4dtjuph3.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6F66.tmp" "c:\Users\Admin\AppData\Local\Temp\4dtjuph3\CSC23962D76F81E45C18AAA4A90D0D661D2.TMP"
    3⤵
    PID:1660
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -file "C:\Users\Admin\AppData\Local\Temp\3090bff3d16b0b150444c3bfb196229ba0ab0b6b826fa306803de0192beddb80.ps1"
  2⤵
  - Blacklisted process makes network request
  - Modifies extensions of user files
  - Drops startup file
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jxhag211\jxhag211.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1008
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES96F2.tmp" "c:\Users\Admin\AppData\Local\Temp\jxhag211\CSC403EF5937FA94C61B7C471C07FB5FE25.TMP"
      4⤵
      PID:396

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/828-53-0x000007FEF8550000-0x000007FEF87CA000-memory.dmp

Filesize
2.5MB

Download
memory/836-13-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/836-3-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/836-2-0x000000001AC10000-0x000000001AC11000-memory.dmp

Filesize
4KB

Download
memory/836-4-0x0000000002770000-0x0000000002771000-memory.dmp

Filesize
4KB

Download
memory/836-5-0x000000001C6D0000-0x000000001C6D1000-memory.dmp

Filesize
4KB

Download
memory/836-1-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/836-0-0x000007FEF6940000-0x000007FEF732C000-memory.dmp

Filesize
9.9MB

Download
memory/1908-33-0x0000000006490000-0x0000000006491000-memory.dmp

Filesize
4KB

Download
memory/1908-40-0x0000000006530000-0x0000000006531000-memory.dmp

Filesize
4KB

Download
memory/1908-41-0x0000000006550000-0x0000000006551000-memory.dmp

Filesize
4KB

Download
memory/1908-32-0x0000000006310000-0x0000000006311000-memory.dmp

Filesize
4KB

Download
memory/1908-27-0x0000000006200000-0x0000000006201000-memory.dmp

Filesize
4KB

Download
memory/1908-19-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/1908-18-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/1908-17-0x0000000004810000-0x0000000004811000-memory.dmp

Filesize
4KB

Download
memory/1908-16-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1908-15-0x0000000074510000-0x0000000074BFE000-memory.dmp

Filesize
6.9MB

Download
memory/1908-51-0x0000000006640000-0x0000000006641000-memory.dmp

Filesize
4KB

Download
memory/1908-52-0x00000000068D0000-0x00000000068E5000-memory.dmp

Filesize
84KB

Download
memory/1908-54-0x00000000069FF000-0x0000000006A0F000-memory.dmp

Filesize
64KB

Download

Resubmissions

Analysis

Sharing