Analysis
-
max time kernel
28s -
max time network
22s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
21-10-2020 16:15
Static task
static1
Behavioral task
behavioral1
Sample
8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.exe
Resource
win10
General
-
Target
8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.exe
-
Size
1.2MB
-
MD5
7e34c5bd27f25a1e1d47a27702708e28
-
SHA1
fb65ea1cc1d81a17effe16ecd2d10f34975a67d8
-
SHA256
8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01
-
SHA512
2b4099e3f15dfd6414c812e87c5f8cfd1926234012e6c67e71433bc4bed7c823ca6d19f8bb927d16ee8e32859b663a9cbccc890eedb3cdaebb8ec2c04784114f
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
Processes:
Diag:binDiag.exepid process 756 Diag:bin 1508 Diag.exe -
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
Diag.exedescription ioc process File created C:\Users\Admin\Pictures\DisconnectInstall.raw.easy2lock_read_me Diag.exe File opened for modification C:\Users\Admin\Pictures\DisconnectInstall.raw.easy2lock Diag.exe File renamed C:\Users\Admin\Pictures\SearchSet.tiff => C:\Users\Admin\Pictures\SearchSet.tiff.easy2lock Diag.exe File created C:\Users\Admin\Pictures\WaitGroup.tif.easy2lock_read_me Diag.exe File opened for modification C:\Users\Admin\Pictures\WaitGroup.tif.easy2lock Diag.exe File renamed C:\Users\Admin\Pictures\DisconnectInstall.raw => C:\Users\Admin\Pictures\DisconnectInstall.raw.easy2lock Diag.exe File created C:\Users\Admin\Pictures\JoinUninstall.tiff.easy2lock_read_me Diag.exe File renamed C:\Users\Admin\Pictures\JoinUninstall.tiff => C:\Users\Admin\Pictures\JoinUninstall.tiff.easy2lock Diag.exe File opened for modification C:\Users\Admin\Pictures\JoinUninstall.tiff.easy2lock Diag.exe File created C:\Users\Admin\Pictures\SearchSet.tiff.easy2lock_read_me Diag.exe File opened for modification C:\Users\Admin\Pictures\SearchSet.tiff.easy2lock Diag.exe File renamed C:\Users\Admin\Pictures\WaitGroup.tif => C:\Users\Admin\Pictures\WaitGroup.tif.easy2lock Diag.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 1640 takeown.exe 1584 icacls.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 580 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.exepid process 848 8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.exe 848 8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 1640 takeown.exe 1584 icacls.exe -
Drops file in System32 directory 2 IoCs
Processes:
Diag:binattrib.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Diag.exe Diag:bin File opened for modification C:\Windows\SysWOW64\Diag.exe attrib.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1056 vssadmin.exe -
NTFS ADS 1 IoCs
Processes:
8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Diag:bin 8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1540 vssvc.exe Token: SeRestorePrivilege 1540 vssvc.exe Token: SeAuditPrivilege 1540 vssvc.exe -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.exeDiag:binDiag.execmd.execmd.execmd.exedescription pid process target process PID 848 wrote to memory of 756 848 8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.exe Diag:bin PID 848 wrote to memory of 756 848 8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.exe Diag:bin PID 848 wrote to memory of 756 848 8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.exe Diag:bin PID 848 wrote to memory of 756 848 8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.exe Diag:bin PID 756 wrote to memory of 1056 756 Diag:bin vssadmin.exe PID 756 wrote to memory of 1056 756 Diag:bin vssadmin.exe PID 756 wrote to memory of 1056 756 Diag:bin vssadmin.exe PID 756 wrote to memory of 1056 756 Diag:bin vssadmin.exe PID 756 wrote to memory of 1640 756 Diag:bin takeown.exe PID 756 wrote to memory of 1640 756 Diag:bin takeown.exe PID 756 wrote to memory of 1640 756 Diag:bin takeown.exe PID 756 wrote to memory of 1640 756 Diag:bin takeown.exe PID 756 wrote to memory of 1584 756 Diag:bin icacls.exe PID 756 wrote to memory of 1584 756 Diag:bin icacls.exe PID 756 wrote to memory of 1584 756 Diag:bin icacls.exe PID 756 wrote to memory of 1584 756 Diag:bin icacls.exe PID 1508 wrote to memory of 1992 1508 Diag.exe cmd.exe PID 1508 wrote to memory of 1992 1508 Diag.exe cmd.exe PID 1508 wrote to memory of 1992 1508 Diag.exe cmd.exe PID 1508 wrote to memory of 1992 1508 Diag.exe cmd.exe PID 1992 wrote to memory of 1972 1992 cmd.exe choice.exe PID 1992 wrote to memory of 1972 1992 cmd.exe choice.exe PID 1992 wrote to memory of 1972 1992 cmd.exe choice.exe PID 1992 wrote to memory of 1972 1992 cmd.exe choice.exe PID 756 wrote to memory of 676 756 Diag:bin cmd.exe PID 756 wrote to memory of 676 756 Diag:bin cmd.exe PID 756 wrote to memory of 676 756 Diag:bin cmd.exe PID 756 wrote to memory of 676 756 Diag:bin cmd.exe PID 848 wrote to memory of 580 848 8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.exe cmd.exe PID 848 wrote to memory of 580 848 8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.exe cmd.exe PID 848 wrote to memory of 580 848 8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.exe cmd.exe PID 848 wrote to memory of 580 848 8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.exe cmd.exe PID 676 wrote to memory of 1392 676 cmd.exe choice.exe PID 676 wrote to memory of 1392 676 cmd.exe choice.exe PID 676 wrote to memory of 1392 676 cmd.exe choice.exe PID 676 wrote to memory of 1392 676 cmd.exe choice.exe PID 580 wrote to memory of 1548 580 cmd.exe choice.exe PID 580 wrote to memory of 1548 580 cmd.exe choice.exe PID 580 wrote to memory of 1548 580 cmd.exe choice.exe PID 580 wrote to memory of 1548 580 cmd.exe choice.exe PID 1992 wrote to memory of 2032 1992 cmd.exe attrib.exe PID 1992 wrote to memory of 2032 1992 cmd.exe attrib.exe PID 1992 wrote to memory of 2032 1992 cmd.exe attrib.exe PID 1992 wrote to memory of 2032 1992 cmd.exe attrib.exe PID 580 wrote to memory of 1468 580 cmd.exe attrib.exe PID 580 wrote to memory of 1468 580 cmd.exe attrib.exe PID 580 wrote to memory of 1468 580 cmd.exe attrib.exe PID 580 wrote to memory of 1468 580 cmd.exe attrib.exe PID 676 wrote to memory of 1516 676 cmd.exe attrib.exe PID 676 wrote to memory of 1516 676 cmd.exe attrib.exe PID 676 wrote to memory of 1516 676 cmd.exe attrib.exe PID 676 wrote to memory of 1516 676 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 3 IoCs
Processes:
attrib.exeattrib.exeattrib.exepid process 1468 attrib.exe 1516 attrib.exe 2032 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.exe"C:\Users\Admin\AppData\Local\Temp\8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.exe"1⤵
- Loads dropped DLL
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Diag:binC:\Users\Admin\AppData\Roaming\Diag:bin -r2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\takeown.exeC:\Windows\system32\takeown.exe /F C:\Windows\system32\Diag.exe3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exeC:\Windows\system32\icacls.exe C:\Windows\system32\Diag.exe /reset3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Roaming\Diag" & del "C:\Users\Admin\AppData\Roaming\Diag"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y4⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Roaming\Diag"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.exe" & del "C:\Users\Admin\AppData\Local\Temp\8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Local\Temp\8dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01.exe"3⤵
- Views/modifies file attributes
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Diag.exeC:\Windows\SysWOW64\Diag.exe -s1⤵
- Executes dropped EXE
- Modifies extensions of user files
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Windows\SysWOW64\Diag.exe" & del "C:\Windows\SysWOW64\Diag.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Windows\SysWOW64\Diag.exe"3⤵
- Drops file in System32 directory
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Diag:binMD5
7e34c5bd27f25a1e1d47a27702708e28
SHA1fb65ea1cc1d81a17effe16ecd2d10f34975a67d8
SHA2568dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01
SHA5122b4099e3f15dfd6414c812e87c5f8cfd1926234012e6c67e71433bc4bed7c823ca6d19f8bb927d16ee8e32859b663a9cbccc890eedb3cdaebb8ec2c04784114f
-
C:\Users\Admin\AppData\Roaming\Diag:binMD5
7e34c5bd27f25a1e1d47a27702708e28
SHA1fb65ea1cc1d81a17effe16ecd2d10f34975a67d8
SHA2568dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01
SHA5122b4099e3f15dfd6414c812e87c5f8cfd1926234012e6c67e71433bc4bed7c823ca6d19f8bb927d16ee8e32859b663a9cbccc890eedb3cdaebb8ec2c04784114f
-
C:\Windows\SysWOW64\Diag.exeMD5
7e34c5bd27f25a1e1d47a27702708e28
SHA1fb65ea1cc1d81a17effe16ecd2d10f34975a67d8
SHA2568dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01
SHA5122b4099e3f15dfd6414c812e87c5f8cfd1926234012e6c67e71433bc4bed7c823ca6d19f8bb927d16ee8e32859b663a9cbccc890eedb3cdaebb8ec2c04784114f
-
C:\Windows\SysWOW64\Diag.exeMD5
7e34c5bd27f25a1e1d47a27702708e28
SHA1fb65ea1cc1d81a17effe16ecd2d10f34975a67d8
SHA2568dc3389d37519b24aef2bcf2a15530ea1b13ff4b98228967c9876835bdb99a01
SHA5122b4099e3f15dfd6414c812e87c5f8cfd1926234012e6c67e71433bc4bed7c823ca6d19f8bb927d16ee8e32859b663a9cbccc890eedb3cdaebb8ec2c04784114f
-
\Users\Admin\AppData\Roaming\DiagMD5
207cf171b1c6b8ae50c1fbf87363eebc
SHA1a26252ed88a6330f7d4919c25ae2511b02a2840f
SHA256c1acacb32a63b52a08af2a52b4736b9d737116aeebd51c28eae804a03497642a
SHA512e5e5d64f3722c111b045c0b49c327b7815bd134dd7dd850faeaf65501a59d1c45e8495cfda2fe48edc53a975c7ddc7894dfa4bc916db15b91b78fd7ed7001b64
-
\Users\Admin\AppData\Roaming\DiagMD5
207cf171b1c6b8ae50c1fbf87363eebc
SHA1a26252ed88a6330f7d4919c25ae2511b02a2840f
SHA256c1acacb32a63b52a08af2a52b4736b9d737116aeebd51c28eae804a03497642a
SHA512e5e5d64f3722c111b045c0b49c327b7815bd134dd7dd850faeaf65501a59d1c45e8495cfda2fe48edc53a975c7ddc7894dfa4bc916db15b91b78fd7ed7001b64
-
memory/580-13-0x0000000000000000-mapping.dmp
-
memory/676-12-0x0000000000000000-mapping.dmp
-
memory/756-2-0x0000000000000000-mapping.dmp
-
memory/1056-4-0x0000000000000000-mapping.dmp
-
memory/1392-14-0x0000000000000000-mapping.dmp
-
memory/1468-17-0x0000000000000000-mapping.dmp
-
memory/1516-18-0x0000000000000000-mapping.dmp
-
memory/1548-15-0x0000000000000000-mapping.dmp
-
memory/1584-8-0x0000000000000000-mapping.dmp
-
memory/1640-6-0x0000000000000000-mapping.dmp
-
memory/1972-11-0x0000000000000000-mapping.dmp
-
memory/1992-10-0x0000000000000000-mapping.dmp
-
memory/2032-16-0x0000000000000000-mapping.dmp