Analysis
-
max time kernel
20s -
max time network
110s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
21-10-2020 16:05
Static task
static1
Behavioral task
behavioral1
Sample
633e3f41ab072d59eb255348209fd3228a8abc3168601c7f95342ef85efdc6b2.bin.exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
633e3f41ab072d59eb255348209fd3228a8abc3168601c7f95342ef85efdc6b2.bin.exe
Resource
win10v200722
General
-
Target
633e3f41ab072d59eb255348209fd3228a8abc3168601c7f95342ef85efdc6b2.bin.exe
-
Size
1.2MB
-
MD5
ad90a317e686b1ab9db651c97ee448b2
-
SHA1
5a2e9db7daa14511f8fb4e5a9e93e9721d68e593
-
SHA256
633e3f41ab072d59eb255348209fd3228a8abc3168601c7f95342ef85efdc6b2
-
SHA512
65ebd80b4118d41acc1371ede9a9ee4b37011ed2a03dc7751d3e6d3fc92b9bb6956a442e8c38266bd5c97afdd4d68ebc1657ff2faf35c42e9d28aadf15006353
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
Processes:
E0-4:binE0-4.exepid process 1312 E0-4:bin 688 E0-4.exe -
Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
E0-4.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\SuspendShow.tiff.easy2lock E0-4.exe File opened for modification C:\Users\Admin\Pictures\ExportSwitch.raw.easy2lock E0-4.exe File created C:\Users\Admin\Pictures\SetSync.crw.easy2lock_read_me E0-4.exe File renamed C:\Users\Admin\Pictures\SetSync.crw => C:\Users\Admin\Pictures\SetSync.crw.easy2lock E0-4.exe File opened for modification C:\Users\Admin\Pictures\SetSync.crw.easy2lock E0-4.exe File created C:\Users\Admin\Pictures\SuspendShow.tiff.easy2lock_read_me E0-4.exe File created C:\Users\Admin\Pictures\ExportSwitch.raw.easy2lock_read_me E0-4.exe File renamed C:\Users\Admin\Pictures\ExportSwitch.raw => C:\Users\Admin\Pictures\ExportSwitch.raw.easy2lock E0-4.exe File renamed C:\Users\Admin\Pictures\SuspendShow.tiff => C:\Users\Admin\Pictures\SuspendShow.tiff.easy2lock E0-4.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 2516 takeown.exe 2296 icacls.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 2516 takeown.exe 2296 icacls.exe -
Drops file in System32 directory 2 IoCs
Processes:
E0-4:binattrib.exedescription ioc process File opened for modification C:\Windows\SysWOW64\E0-4.exe E0-4:bin File opened for modification C:\Windows\SysWOW64\E0-4.exe attrib.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2220 vssadmin.exe -
NTFS ADS 1 IoCs
Processes:
633e3f41ab072d59eb255348209fd3228a8abc3168601c7f95342ef85efdc6b2.bin.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\E0-4:bin 633e3f41ab072d59eb255348209fd3228a8abc3168601c7f95342ef85efdc6b2.bin.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 2420 vssvc.exe Token: SeRestorePrivilege 2420 vssvc.exe Token: SeAuditPrivilege 2420 vssvc.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
633e3f41ab072d59eb255348209fd3228a8abc3168601c7f95342ef85efdc6b2.bin.exeE0-4:binE0-4.execmd.execmd.execmd.exedescription pid process target process PID 3996 wrote to memory of 1312 3996 633e3f41ab072d59eb255348209fd3228a8abc3168601c7f95342ef85efdc6b2.bin.exe E0-4:bin PID 3996 wrote to memory of 1312 3996 633e3f41ab072d59eb255348209fd3228a8abc3168601c7f95342ef85efdc6b2.bin.exe E0-4:bin PID 3996 wrote to memory of 1312 3996 633e3f41ab072d59eb255348209fd3228a8abc3168601c7f95342ef85efdc6b2.bin.exe E0-4:bin PID 1312 wrote to memory of 2220 1312 E0-4:bin vssadmin.exe PID 1312 wrote to memory of 2220 1312 E0-4:bin vssadmin.exe PID 1312 wrote to memory of 2516 1312 E0-4:bin takeown.exe PID 1312 wrote to memory of 2516 1312 E0-4:bin takeown.exe PID 1312 wrote to memory of 2516 1312 E0-4:bin takeown.exe PID 1312 wrote to memory of 2296 1312 E0-4:bin icacls.exe PID 1312 wrote to memory of 2296 1312 E0-4:bin icacls.exe PID 1312 wrote to memory of 2296 1312 E0-4:bin icacls.exe PID 688 wrote to memory of 1844 688 E0-4.exe cmd.exe PID 688 wrote to memory of 1844 688 E0-4.exe cmd.exe PID 688 wrote to memory of 1844 688 E0-4.exe cmd.exe PID 1844 wrote to memory of 1492 1844 cmd.exe choice.exe PID 1844 wrote to memory of 1492 1844 cmd.exe choice.exe PID 1844 wrote to memory of 1492 1844 cmd.exe choice.exe PID 1312 wrote to memory of 1092 1312 E0-4:bin cmd.exe PID 1312 wrote to memory of 1092 1312 E0-4:bin cmd.exe PID 1312 wrote to memory of 1092 1312 E0-4:bin cmd.exe PID 3996 wrote to memory of 3916 3996 633e3f41ab072d59eb255348209fd3228a8abc3168601c7f95342ef85efdc6b2.bin.exe cmd.exe PID 3996 wrote to memory of 3916 3996 633e3f41ab072d59eb255348209fd3228a8abc3168601c7f95342ef85efdc6b2.bin.exe cmd.exe PID 3996 wrote to memory of 3916 3996 633e3f41ab072d59eb255348209fd3228a8abc3168601c7f95342ef85efdc6b2.bin.exe cmd.exe PID 1092 wrote to memory of 1788 1092 cmd.exe choice.exe PID 1092 wrote to memory of 1788 1092 cmd.exe choice.exe PID 1092 wrote to memory of 1788 1092 cmd.exe choice.exe PID 3916 wrote to memory of 3856 3916 cmd.exe choice.exe PID 3916 wrote to memory of 3856 3916 cmd.exe choice.exe PID 3916 wrote to memory of 3856 3916 cmd.exe choice.exe PID 1844 wrote to memory of 2400 1844 cmd.exe attrib.exe PID 1844 wrote to memory of 2400 1844 cmd.exe attrib.exe PID 1844 wrote to memory of 2400 1844 cmd.exe attrib.exe PID 3916 wrote to memory of 2352 3916 cmd.exe attrib.exe PID 3916 wrote to memory of 2352 3916 cmd.exe attrib.exe PID 3916 wrote to memory of 2352 3916 cmd.exe attrib.exe PID 1092 wrote to memory of 2248 1092 cmd.exe attrib.exe PID 1092 wrote to memory of 2248 1092 cmd.exe attrib.exe PID 1092 wrote to memory of 2248 1092 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 3 IoCs
Processes:
attrib.exeattrib.exeattrib.exepid process 2400 attrib.exe 2352 attrib.exe 2248 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\633e3f41ab072d59eb255348209fd3228a8abc3168601c7f95342ef85efdc6b2.bin.exe"C:\Users\Admin\AppData\Local\Temp\633e3f41ab072d59eb255348209fd3228a8abc3168601c7f95342ef85efdc6b2.bin.exe"1⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\E0-4:binC:\Users\Admin\AppData\Roaming\E0-4:bin -r2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\takeown.exeC:\Windows\system32\takeown.exe /F C:\Windows\system32\E0-4.exe3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exeC:\Windows\system32\icacls.exe C:\Windows\system32\E0-4.exe /reset3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Roaming\E0-4" & del "C:\Users\Admin\AppData\Roaming\E0-4"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y4⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Roaming\E0-4"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\633e3f41ab072d59eb255348209fd3228a8abc3168601c7f95342ef85efdc6b2.bin.exe" & del "C:\Users\Admin\AppData\Local\Temp\633e3f41ab072d59eb255348209fd3228a8abc3168601c7f95342ef85efdc6b2.bin.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Local\Temp\633e3f41ab072d59eb255348209fd3228a8abc3168601c7f95342ef85efdc6b2.bin.exe"3⤵
- Views/modifies file attributes
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\E0-4.exeC:\Windows\SysWOW64\E0-4.exe -s1⤵
- Executes dropped EXE
- Modifies extensions of user files
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Windows\SysWOW64\E0-4.exe" & del "C:\Windows\SysWOW64\E0-4.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Windows\SysWOW64\E0-4.exe"3⤵
- Drops file in System32 directory
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\E0-4:binMD5
ad90a317e686b1ab9db651c97ee448b2
SHA15a2e9db7daa14511f8fb4e5a9e93e9721d68e593
SHA256633e3f41ab072d59eb255348209fd3228a8abc3168601c7f95342ef85efdc6b2
SHA51265ebd80b4118d41acc1371ede9a9ee4b37011ed2a03dc7751d3e6d3fc92b9bb6956a442e8c38266bd5c97afdd4d68ebc1657ff2faf35c42e9d28aadf15006353
-
C:\Users\Admin\AppData\Roaming\E0-4:binMD5
ad90a317e686b1ab9db651c97ee448b2
SHA15a2e9db7daa14511f8fb4e5a9e93e9721d68e593
SHA256633e3f41ab072d59eb255348209fd3228a8abc3168601c7f95342ef85efdc6b2
SHA51265ebd80b4118d41acc1371ede9a9ee4b37011ed2a03dc7751d3e6d3fc92b9bb6956a442e8c38266bd5c97afdd4d68ebc1657ff2faf35c42e9d28aadf15006353
-
C:\Windows\SysWOW64\E0-4.exeMD5
ad90a317e686b1ab9db651c97ee448b2
SHA15a2e9db7daa14511f8fb4e5a9e93e9721d68e593
SHA256633e3f41ab072d59eb255348209fd3228a8abc3168601c7f95342ef85efdc6b2
SHA51265ebd80b4118d41acc1371ede9a9ee4b37011ed2a03dc7751d3e6d3fc92b9bb6956a442e8c38266bd5c97afdd4d68ebc1657ff2faf35c42e9d28aadf15006353
-
C:\Windows\SysWOW64\E0-4.exeMD5
ad90a317e686b1ab9db651c97ee448b2
SHA15a2e9db7daa14511f8fb4e5a9e93e9721d68e593
SHA256633e3f41ab072d59eb255348209fd3228a8abc3168601c7f95342ef85efdc6b2
SHA51265ebd80b4118d41acc1371ede9a9ee4b37011ed2a03dc7751d3e6d3fc92b9bb6956a442e8c38266bd5c97afdd4d68ebc1657ff2faf35c42e9d28aadf15006353
-
memory/1092-10-0x0000000000000000-mapping.dmp
-
memory/1312-0-0x0000000000000000-mapping.dmp
-
memory/1492-9-0x0000000000000000-mapping.dmp
-
memory/1788-12-0x0000000000000000-mapping.dmp
-
memory/1844-8-0x0000000000000000-mapping.dmp
-
memory/2220-3-0x0000000000000000-mapping.dmp
-
memory/2248-16-0x0000000000000000-mapping.dmp
-
memory/2296-6-0x0000000000000000-mapping.dmp
-
memory/2352-15-0x0000000000000000-mapping.dmp
-
memory/2400-14-0x0000000000000000-mapping.dmp
-
memory/2516-4-0x0000000000000000-mapping.dmp
-
memory/3856-13-0x0000000000000000-mapping.dmp
-
memory/3916-11-0x0000000000000000-mapping.dmp