Analysis

  • max time kernel
    99s
  • max time network
    125s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    01-10-2020 16:10

General

  • Target

    excorsist.bin.exe

  • Size

    68KB

  • MD5

    9e5c89c84cdbf460fc6857c4e32dafdf

  • SHA1

    ee0a95846ce48c59261eda0fdd6b38dfc83d9f4d

  • SHA256

    dfecb46078038bcfa9d0b8db18bdc0646f33bad55ee7dd5ee46e61c6cf399620

  • SHA512

    6da517ae5159ebcb0ac138b34215924fb21adae619c3c15ede6863866648e445633f482b2beaddbe74de66b48e18d106dbde3253ee2d3ce86da667f7f8494cd8

Malware Config

Signatures

  • Exorcist Ransomware

    Ransomware-as-a-service which avoids infecting machines in CIS nations. First seen in mid-2020.

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies service 2 TTPs 4 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies data under HKEY_USERS 484 IoCs
  • NTFS ADS 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 5070 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\excorsist.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\excorsist.bin.exe"
    1⤵
    • Modifies extensions of user files
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Modifies data under HKEY_USERS
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2920
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C vssadmin Delete Shadows /All /Quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3856
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin Delete Shadows /All /Quiet
        3⤵
        • Interacts with shadow copies
        PID:1320
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C bcdedit /set {default} recoveryenabled No
      2⤵
        PID:1220
      • C:\Windows\SysWOW64\cmd.exe
        cmd /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
        2⤵
          PID:1464
        • C:\Windows\SysWOW64\cmd.exe
          cmd /C wbadmin DELETE SYSTEMSTATEBACKUP
          2⤵
            PID:1816
          • C:\Windows\SysWOW64\cmd.exe
            cmd /C wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
            2⤵
              PID:1664
            • C:\Windows\SysWOW64\cmd.exe
              cmd /C wmic SHADOWCOPY /nointeractive
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2140
              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                wmic SHADOWCOPY /nointeractive
                3⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2556
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Modifies service
            • Suspicious use of AdjustPrivilegeToken
            PID:424

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2920-8-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-9-0x0000000005560000-0x0000000005561000-memory.dmp

            Filesize

            4KB

          • memory/2920-10-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-11-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-12-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-13-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-14-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-15-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-16-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-17-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-18-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-19-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-20-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-21-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-22-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-23-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-24-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-25-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-26-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-27-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-28-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-29-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-30-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-31-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-32-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-33-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-34-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-35-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-36-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-37-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-38-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-39-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-40-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-41-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-42-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-43-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-44-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-45-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-46-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-47-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-48-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-49-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-50-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-51-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-52-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-53-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-54-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-55-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-56-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-57-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-58-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-59-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-60-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-61-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-62-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-63-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-64-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-65-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-66-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-67-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-68-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-69-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-70-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-71-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-72-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-73-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-74-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-75-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-76-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-77-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-78-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-79-0x0000000004D40000-0x0000000004D41000-memory.dmp

            Filesize

            4KB

          • memory/2920-81-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-82-0x0000000005560000-0x0000000005561000-memory.dmp

            Filesize

            4KB

          • memory/2920-154-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-156-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-158-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-160-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-162-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-164-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-166-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-167-0x0000000005560000-0x0000000005561000-memory.dmp

            Filesize

            4KB

          • memory/2920-168-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-170-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-172-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-174-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-176-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-178-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-180-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-182-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-184-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-186-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-188-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-190-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-192-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-193-0x0000000005560000-0x0000000005561000-memory.dmp

            Filesize

            4KB

          • memory/2920-194-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-196-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-198-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-200-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-202-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-204-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-205-0x0000000005560000-0x0000000005561000-memory.dmp

            Filesize

            4KB

          • memory/2920-206-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-208-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-210-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-212-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-214-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-216-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-218-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-220-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-222-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-224-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-226-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-228-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-230-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-232-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-234-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-236-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-238-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-240-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-242-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-244-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-246-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-248-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-250-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-252-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-254-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-256-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-258-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-260-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-262-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-264-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-266-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-268-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-270-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-272-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-274-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-276-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-278-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-280-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-282-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-284-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-286-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-288-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-290-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-292-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-294-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-296-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-298-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-300-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-302-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-304-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-306-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-308-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-310-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-312-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-314-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-316-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-318-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-320-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-322-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-324-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-326-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-328-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-330-0x0000000004D60000-0x0000000004D61000-memory.dmp

            Filesize

            4KB

          • memory/2920-451-0x0000000001000000-0x00000000010C6000-memory.dmp

            Filesize

            792KB