Analysis
-
max time kernel
258s -
max time network
261s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
01-10-2020 14:18
Static task
static1
Behavioral task
behavioral1
Sample
run.bat
Resource
win7
Behavioral task
behavioral2
Sample
run.bat
Resource
win10v200722
General
-
Target
run.bat
-
Size
131B
-
MD5
8edbf5df7aebe871b491e0ec7e52038a
-
SHA1
f41b24074ed38cad1be394ff7cb5a7086c6b7fa1
-
SHA256
d4088bf2fe9e25800f51bc1176ae711a3f1038fedeb72d9c406ed963795a1f8f
-
SHA512
682ea13ef588627b5d3955cab498b21390031b1042fab0532d4273c78564a957641f3f303e8b42a6b90472483eb49ed5dc0bf1aac58b910d51d0b7f4b0c1ff0b
Malware Config
Extracted
C:\RECOVER-FILES.txt
sekhmet
http://o3n4bhhtybbtwqqs.onion/B36B1ABBE151F36D
https://sekhmet.top/B36B1ABBE151F36D
Signatures
-
Sekhmet Ransomware
Ransomware family active in the wild since early 2020.
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
regsvr32.exedescription ioc process File renamed C:\Users\Admin\Pictures\CheckpointSkip.crw => C:\Users\Admin\Pictures\CheckpointSkip.crw.odHh regsvr32.exe File opened for modification C:\Users\Admin\Pictures\UnblockUnregister.tiff regsvr32.exe File renamed C:\Users\Admin\Pictures\UnblockUnregister.tiff => C:\Users\Admin\Pictures\UnblockUnregister.tiff.kTTzrc regsvr32.exe -
Drops startup file 4 IoCs
Processes:
regsvr32.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RECOVER-FILES.txt regsvr32.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e6189640.lnk regsvr32.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RECOVER-FILES.txt regsvr32.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\e6189640.lnk regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Drops file in Program Files directory 4 IoCs
Processes:
regsvr32.exedescription ioc process File created C:\Program Files\e6189640.lnk regsvr32.exe File created C:\Program Files\RECOVER-FILES.txt regsvr32.exe File created C:\Program Files (x86)\e6189640.lnk regsvr32.exe File created C:\Program Files (x86)\RECOVER-FILES.txt regsvr32.exe -
Drops file in Windows directory 2 IoCs
Processes:
regsvr32.exedescription ioc process File created C:\Windows\e6189640.lnk regsvr32.exe File created C:\Windows\RECOVER-FILES.txt regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
regsvr32.exepid process 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe 2608 regsvr32.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
regsvr32.exepid process 2608 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
vssvc.exeregsvr32.exedescription pid process Token: SeBackupPrivilege 2076 vssvc.exe Token: SeRestorePrivilege 2076 vssvc.exe Token: SeAuditPrivilege 2076 vssvc.exe Token: SeDebugPrivilege 2608 regsvr32.exe Token: SeDebugPrivilege 2608 regsvr32.exe Token: SeDebugPrivilege 2608 regsvr32.exe Token: SeDebugPrivilege 2608 regsvr32.exe Token: SeDebugPrivilege 2608 regsvr32.exe Token: SeDebugPrivilege 2608 regsvr32.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
cmd.exeregsvr32.exedescription pid process target process PID 864 wrote to memory of 2172 864 cmd.exe regsvr32.exe PID 864 wrote to memory of 2172 864 cmd.exe regsvr32.exe PID 2172 wrote to memory of 2608 2172 regsvr32.exe regsvr32.exe PID 2172 wrote to memory of 2608 2172 regsvr32.exe regsvr32.exe PID 2172 wrote to memory of 2608 2172 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\run.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Windows\system32\regsvr32.exeregsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\fceb299326ef4298a3c30e10b31d8c64f1369b182ac256d1eeaf148c1adcea8d.dll"2⤵
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Users\Admin\AppData\Local\Temp\fceb299326ef4298a3c30e10b31d8c64f1369b182ac256d1eeaf148c1adcea8d.dll"3⤵
- Modifies extensions of user files
- Drops startup file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:2608
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:2076