suncrypt | 63ba6db8c81c60dd9f1a0c7c4a4c51e2e56883f063509ed7b543ad7651fd8806

Analysis

max time kernel
57s
max time network
66s
platform
windows7_x64
resource
win7
submitted
05-10-2020 08:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63ba6db8c81c60dd9f1a0c7c4a4c51e2e56883f063509ed7b543ad7651fd8806.ps1
Size

1.6MB
MD5

c171bcd34151cbcd48edbce13796e0ed
SHA1

2770fec86275dfb1a4a05e2d56bc27a089197666
SHA256

63ba6db8c81c60dd9f1a0c7c4a4c51e2e56883f063509ed7b543ad7651fd8806
SHA512

d25cbb70dae9bcc49d32c15300734879fe4c1b7ae35cb5affab50e8a61ae7226832b278d846f76f7eedc3a1baf35e2aec4e8c364eab99cddb00c2ffeb97283da

Score

10^/10

persistence spyware ransomware suncrypt

Malware Config

Signatures

SunCrypt Ransomware
Family which threatens to leak data alongside encrypting files. Has claimed to be collaborating with the Maze ransomware group.
ransomware suncrypt

Blacklisted process makes network request 1 IoCs

flow	pid	Process
6	1988	powershell.exe

Modifies extensions of user files 6 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\CloseRequest.tiff	powershell.exe
File opened for modification	C:\Users\Admin\Pictures\InstallRegister.tiff	powershell.exe
File renamed	C:\Users\Admin\Pictures\CloseRequest.tiff => C:\Users\Admin\Pictures\CloseRequest.tiff.65534A05975BF04B53430708FF9E0DBC3B587BE8CFE7478D4D2505D05A12A93D	powershell.exe
File renamed	C:\Users\Admin\Pictures\GroupInvoke.crw => C:\Users\Admin\Pictures\GroupInvoke.crw.EFA1F8C06A9FC9DA2F5E0D9D30CA3FF6BFF9144C141EDDC31610B66B7ED27211	powershell.exe
File renamed	C:\Users\Admin\Pictures\InstallRegister.tiff => C:\Users\Admin\Pictures\InstallRegister.tiff.7AFD42031A724DC5D59003F2782845AE3EACB2334F066B8325885383D40A3458	powershell.exe
File renamed	C:\Users\Admin\Pictures\SplitUnlock.tif => C:\Users\Admin\Pictures\SplitUnlock.tif.27482F072767359798181B5909A3E3CD153333F4E19727025808F5E1F9B44164	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\YOUR_FILES_ARE_ENCRYPTED.HTML	powershell.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 35 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	powershell.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	powershell.exe
File opened for modification	C:\Users\Public\desktop.ini	powershell.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	powershell.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	powershell.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	powershell.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AJM03J3Y\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	powershell.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	powershell.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	powershell.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	powershell.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RBDIK06K\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	powershell.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	powershell.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\TGVUK4BG\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZMLBLRQ7\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	powershell.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	powershell.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	powershell.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	powershell.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	powershell.exe
File opened (read-only)	\??\Z:	powershell.exe
File opened (read-only)	\??\U:	powershell.exe
File opened (read-only)	\??\P:	powershell.exe
File opened (read-only)	\??\H:	powershell.exe
File opened (read-only)	\??\S:	powershell.exe
File opened (read-only)	\??\L:	powershell.exe
File opened (read-only)	\??\V:	powershell.exe
File opened (read-only)	\??\Q:	powershell.exe
File opened (read-only)	\??\W:	powershell.exe
File opened (read-only)	\??\E:	powershell.exe
File opened (read-only)	\??\G:	powershell.exe
File opened (read-only)	\??\J:	powershell.exe
File opened (read-only)	\??\X:	powershell.exe
File opened (read-only)	\??\B:	powershell.exe
File opened (read-only)	\??\Y:	powershell.exe
File opened (read-only)	\??\I:	powershell.exe
File opened (read-only)	\??\O:	powershell.exe
File opened (read-only)	\??\F:	powershell.exe
File opened (read-only)	\??\N:	powershell.exe
File opened (read-only)	\??\M:	powershell.exe
File opened (read-only)	\??\R:	powershell.exe
File opened (read-only)	\??\T:	powershell.exe
File opened (read-only)	\??\A:	powershell.exe

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1588	powershell.exe
1588	powershell.exe
1988	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeDebugPrivilege	1988	powershell.exe
Token: SeBackupPrivilege	1184	vssvc.exe
Token: SeRestorePrivilege	1184	vssvc.exe
Token: SeAuditPrivilege	1184	vssvc.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 1596	1588	powershell.exe	29
PID 1588 wrote to memory of 1596	1588	powershell.exe	29
PID 1588 wrote to memory of 1596	1588	powershell.exe	29
PID 1596 wrote to memory of 1532	1596	csc.exe	30
PID 1596 wrote to memory of 1532	1596	csc.exe	30
PID 1596 wrote to memory of 1532	1596	csc.exe	30
PID 1588 wrote to memory of 1988	1588	powershell.exe	31
PID 1588 wrote to memory of 1988	1588	powershell.exe	31
PID 1588 wrote to memory of 1988	1588	powershell.exe	31
PID 1588 wrote to memory of 1988	1588	powershell.exe	31
PID 1988 wrote to memory of 1484	1988	powershell.exe	33
PID 1988 wrote to memory of 1484	1988	powershell.exe	33
PID 1988 wrote to memory of 1484	1988	powershell.exe	33
PID 1988 wrote to memory of 1484	1988	powershell.exe	33
PID 1484 wrote to memory of 1376	1484	csc.exe	34
PID 1484 wrote to memory of 1376	1484	csc.exe	34
PID 1484 wrote to memory of 1376	1484	csc.exe	34
PID 1484 wrote to memory of 1376	1484	csc.exe	34

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\63ba6db8c81c60dd9f1a0c7c4a4c51e2e56883f063509ed7b543ad7651fd8806.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bvehgn3m\bvehgn3m.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3A14.tmp" "c:\Users\Admin\AppData\Local\Temp\bvehgn3m\CSC56FDA1B0416C46DD8AEABF87D0ACF5C6.TMP"
    3⤵
    PID:1532
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -file "C:\Users\Admin\AppData\Local\Temp\63ba6db8c81c60dd9f1a0c7c4a4c51e2e56883f063509ed7b543ad7651fd8806.ps1"
  2⤵
  - Blacklisted process makes network request
  - Modifies extensions of user files
  - Drops startup file
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\g1nrnwn5\g1nrnwn5.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1484
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES56A8.tmp" "c:\Users\Admin\AppData\Local\Temp\g1nrnwn5\CSC6E1FD697DD4B431B843A58F8EAFD5D4.TMP"
      4⤵
      PID:1376

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:1184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1588-0-0x000007FEF6160000-0x000007FEF6B4C000-memory.dmp

Filesize
9.9MB

Download
memory/1588-1-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/1588-2-0x000000001AD60000-0x000000001AD61000-memory.dmp

Filesize
4KB

Download
memory/1588-3-0x0000000001E60000-0x0000000001E61000-memory.dmp

Filesize
4KB

Download
memory/1588-4-0x0000000001DC0000-0x0000000001DC1000-memory.dmp

Filesize
4KB

Download
memory/1588-13-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/1588-5-0x000000001C5B0000-0x000000001C5B1000-memory.dmp

Filesize
4KB

Download
memory/1788-54-0x000007FEF8040000-0x000007FEF82BA000-memory.dmp

Filesize
2.5MB

Download
memory/1988-19-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/1988-18-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/1988-41-0x00000000065D0000-0x00000000065D1000-memory.dmp

Filesize
4KB

Download
memory/1988-33-0x00000000064B0000-0x00000000064B1000-memory.dmp

Filesize
4KB

Download
memory/1988-32-0x0000000006210000-0x0000000006211000-memory.dmp

Filesize
4KB

Download
memory/1988-27-0x00000000061A0000-0x00000000061A1000-memory.dmp

Filesize
4KB

Download
memory/1988-40-0x0000000006420000-0x0000000006421000-memory.dmp

Filesize
4KB

Download
memory/1988-17-0x0000000004870000-0x0000000004871000-memory.dmp

Filesize
4KB

Download
memory/1988-16-0x0000000002090000-0x0000000002091000-memory.dmp

Filesize
4KB

Download
memory/1988-51-0x0000000006460000-0x0000000006461000-memory.dmp

Filesize
4KB

Download
memory/1988-52-0x00000000068E0000-0x000000000690E000-memory.dmp

Filesize
184KB

Download
memory/1988-15-0x0000000073680000-0x0000000073D6E000-memory.dmp

Filesize
6.9MB

Download
memory/1988-56-0x00000000061F0000-0x00000000061F1000-memory.dmp

Filesize
4KB

Download