Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
03-11-2020 14:20
Static task
static1
Behavioral task
behavioral1
Sample
37a30621364d3083424b24b0255fc8f5752d88c381600d840574e551c284fb6e.bin.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
37a30621364d3083424b24b0255fc8f5752d88c381600d840574e551c284fb6e.bin.exe
Resource
win10v20201028
General
-
Target
37a30621364d3083424b24b0255fc8f5752d88c381600d840574e551c284fb6e.bin.exe
-
Size
58KB
-
MD5
6d9ad19726c79c0f7b4bf91475452e2d
-
SHA1
e6d92f05926c01ed146dbfdf02500c234ccf0888
-
SHA256
37a30621364d3083424b24b0255fc8f5752d88c381600d840574e551c284fb6e
-
SHA512
87923aeb9b0d409975dd0d364a6c12b57afffde944ccb6707cff134d456f6b8e9c1753b63ff7ffcbc0d389c37a1cff1cadc5075e4ecb503ebcabeb3f631b5eb3
Malware Config
Signatures
-
WastedLocker
Ransomware family seen in the wild since May 2020.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
Processes:
Co:binCo.exepid process 1860 Co:bin 1480 Co.exe -
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
Co.exedescription ioc process File created C:\Users\Admin\Pictures\WaitGroup.tif.garminwasted_info Co.exe File renamed C:\Users\Admin\Pictures\WaitGroup.tif => C:\Users\Admin\Pictures\WaitGroup.tif.garminwasted Co.exe File renamed C:\Users\Admin\Pictures\DisconnectInstall.raw => C:\Users\Admin\Pictures\DisconnectInstall.raw.garminwasted Co.exe File renamed C:\Users\Admin\Pictures\JoinUninstall.tiff => C:\Users\Admin\Pictures\JoinUninstall.tiff.garminwasted Co.exe File opened for modification C:\Users\Admin\Pictures\JoinUninstall.tiff.garminwasted Co.exe File renamed C:\Users\Admin\Pictures\SearchSet.tiff => C:\Users\Admin\Pictures\SearchSet.tiff.garminwasted Co.exe File opened for modification C:\Users\Admin\Pictures\SearchSet.tiff.garminwasted Co.exe File opened for modification C:\Users\Admin\Pictures\WaitGroup.tif.garminwasted Co.exe File created C:\Users\Admin\Pictures\DisconnectInstall.raw.garminwasted_info Co.exe File opened for modification C:\Users\Admin\Pictures\DisconnectInstall.raw.garminwasted Co.exe File created C:\Users\Admin\Pictures\JoinUninstall.tiff.garminwasted_info Co.exe File created C:\Users\Admin\Pictures\SearchSet.tiff.garminwasted_info Co.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 1780 takeown.exe 1688 icacls.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1712 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
37a30621364d3083424b24b0255fc8f5752d88c381600d840574e551c284fb6e.bin.exepid process 300 37a30621364d3083424b24b0255fc8f5752d88c381600d840574e551c284fb6e.bin.exe 300 37a30621364d3083424b24b0255fc8f5752d88c381600d840574e551c284fb6e.bin.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 1780 takeown.exe 1688 icacls.exe -
Drops file in System32 directory 2 IoCs
Processes:
Co:binattrib.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Co.exe Co:bin File opened for modification C:\Windows\SysWOW64\Co.exe attrib.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1848 vssadmin.exe -
NTFS ADS 1 IoCs
Processes:
37a30621364d3083424b24b0255fc8f5752d88c381600d840574e551c284fb6e.bin.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Co:bin 37a30621364d3083424b24b0255fc8f5752d88c381600d840574e551c284fb6e.bin.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 2016 vssvc.exe Token: SeRestorePrivilege 2016 vssvc.exe Token: SeAuditPrivilege 2016 vssvc.exe -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
37a30621364d3083424b24b0255fc8f5752d88c381600d840574e551c284fb6e.bin.exeCo:binCo.execmd.execmd.execmd.exedescription pid process target process PID 300 wrote to memory of 1860 300 37a30621364d3083424b24b0255fc8f5752d88c381600d840574e551c284fb6e.bin.exe Co:bin PID 300 wrote to memory of 1860 300 37a30621364d3083424b24b0255fc8f5752d88c381600d840574e551c284fb6e.bin.exe Co:bin PID 300 wrote to memory of 1860 300 37a30621364d3083424b24b0255fc8f5752d88c381600d840574e551c284fb6e.bin.exe Co:bin PID 300 wrote to memory of 1860 300 37a30621364d3083424b24b0255fc8f5752d88c381600d840574e551c284fb6e.bin.exe Co:bin PID 1860 wrote to memory of 1848 1860 Co:bin vssadmin.exe PID 1860 wrote to memory of 1848 1860 Co:bin vssadmin.exe PID 1860 wrote to memory of 1848 1860 Co:bin vssadmin.exe PID 1860 wrote to memory of 1848 1860 Co:bin vssadmin.exe PID 1860 wrote to memory of 1780 1860 Co:bin takeown.exe PID 1860 wrote to memory of 1780 1860 Co:bin takeown.exe PID 1860 wrote to memory of 1780 1860 Co:bin takeown.exe PID 1860 wrote to memory of 1780 1860 Co:bin takeown.exe PID 1860 wrote to memory of 1688 1860 Co:bin icacls.exe PID 1860 wrote to memory of 1688 1860 Co:bin icacls.exe PID 1860 wrote to memory of 1688 1860 Co:bin icacls.exe PID 1860 wrote to memory of 1688 1860 Co:bin icacls.exe PID 1480 wrote to memory of 1268 1480 Co.exe cmd.exe PID 1480 wrote to memory of 1268 1480 Co.exe cmd.exe PID 1480 wrote to memory of 1268 1480 Co.exe cmd.exe PID 1480 wrote to memory of 1268 1480 Co.exe cmd.exe PID 1268 wrote to memory of 1612 1268 cmd.exe choice.exe PID 1268 wrote to memory of 1612 1268 cmd.exe choice.exe PID 1268 wrote to memory of 1612 1268 cmd.exe choice.exe PID 1268 wrote to memory of 1612 1268 cmd.exe choice.exe PID 1860 wrote to memory of 1548 1860 Co:bin cmd.exe PID 1860 wrote to memory of 1548 1860 Co:bin cmd.exe PID 1860 wrote to memory of 1548 1860 Co:bin cmd.exe PID 1860 wrote to memory of 1548 1860 Co:bin cmd.exe PID 300 wrote to memory of 1712 300 37a30621364d3083424b24b0255fc8f5752d88c381600d840574e551c284fb6e.bin.exe cmd.exe PID 300 wrote to memory of 1712 300 37a30621364d3083424b24b0255fc8f5752d88c381600d840574e551c284fb6e.bin.exe cmd.exe PID 300 wrote to memory of 1712 300 37a30621364d3083424b24b0255fc8f5752d88c381600d840574e551c284fb6e.bin.exe cmd.exe PID 300 wrote to memory of 1712 300 37a30621364d3083424b24b0255fc8f5752d88c381600d840574e551c284fb6e.bin.exe cmd.exe PID 1548 wrote to memory of 1704 1548 cmd.exe choice.exe PID 1548 wrote to memory of 1704 1548 cmd.exe choice.exe PID 1548 wrote to memory of 1704 1548 cmd.exe choice.exe PID 1548 wrote to memory of 1704 1548 cmd.exe choice.exe PID 1712 wrote to memory of 1584 1712 cmd.exe choice.exe PID 1712 wrote to memory of 1584 1712 cmd.exe choice.exe PID 1712 wrote to memory of 1584 1712 cmd.exe choice.exe PID 1712 wrote to memory of 1584 1712 cmd.exe choice.exe PID 1268 wrote to memory of 780 1268 cmd.exe attrib.exe PID 1268 wrote to memory of 780 1268 cmd.exe attrib.exe PID 1268 wrote to memory of 780 1268 cmd.exe attrib.exe PID 1268 wrote to memory of 780 1268 cmd.exe attrib.exe PID 1548 wrote to memory of 1788 1548 cmd.exe attrib.exe PID 1548 wrote to memory of 1788 1548 cmd.exe attrib.exe PID 1548 wrote to memory of 1788 1548 cmd.exe attrib.exe PID 1548 wrote to memory of 1788 1548 cmd.exe attrib.exe PID 1712 wrote to memory of 1792 1712 cmd.exe attrib.exe PID 1712 wrote to memory of 1792 1712 cmd.exe attrib.exe PID 1712 wrote to memory of 1792 1712 cmd.exe attrib.exe PID 1712 wrote to memory of 1792 1712 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 3 IoCs
Processes:
attrib.exeattrib.exeattrib.exepid process 1792 attrib.exe 780 attrib.exe 1788 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\37a30621364d3083424b24b0255fc8f5752d88c381600d840574e551c284fb6e.bin.exe"C:\Users\Admin\AppData\Local\Temp\37a30621364d3083424b24b0255fc8f5752d88c381600d840574e551c284fb6e.bin.exe"1⤵
- Loads dropped DLL
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Co:binC:\Users\Admin\AppData\Roaming\Co:bin -r2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\takeown.exeC:\Windows\system32\takeown.exe /F C:\Windows\system32\Co.exe3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exeC:\Windows\system32\icacls.exe C:\Windows\system32\Co.exe /reset3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Roaming\Co" & del "C:\Users\Admin\AppData\Roaming\Co"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y4⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Roaming\Co"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\37a30621364d3083424b24b0255fc8f5752d88c381600d840574e551c284fb6e.bin.exe" & del "C:\Users\Admin\AppData\Local\Temp\37a30621364d3083424b24b0255fc8f5752d88c381600d840574e551c284fb6e.bin.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Local\Temp\37a30621364d3083424b24b0255fc8f5752d88c381600d840574e551c284fb6e.bin.exe"3⤵
- Views/modifies file attributes
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Co.exeC:\Windows\SysWOW64\Co.exe -s1⤵
- Executes dropped EXE
- Modifies extensions of user files
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Windows\SysWOW64\Co.exe" & del "C:\Windows\SysWOW64\Co.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Windows\SysWOW64\Co.exe"3⤵
- Drops file in System32 directory
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Co:binMD5
6d9ad19726c79c0f7b4bf91475452e2d
SHA1e6d92f05926c01ed146dbfdf02500c234ccf0888
SHA25637a30621364d3083424b24b0255fc8f5752d88c381600d840574e551c284fb6e
SHA51287923aeb9b0d409975dd0d364a6c12b57afffde944ccb6707cff134d456f6b8e9c1753b63ff7ffcbc0d389c37a1cff1cadc5075e4ecb503ebcabeb3f631b5eb3
-
C:\Users\Admin\AppData\Roaming\Co:binMD5
6d9ad19726c79c0f7b4bf91475452e2d
SHA1e6d92f05926c01ed146dbfdf02500c234ccf0888
SHA25637a30621364d3083424b24b0255fc8f5752d88c381600d840574e551c284fb6e
SHA51287923aeb9b0d409975dd0d364a6c12b57afffde944ccb6707cff134d456f6b8e9c1753b63ff7ffcbc0d389c37a1cff1cadc5075e4ecb503ebcabeb3f631b5eb3
-
C:\Windows\SysWOW64\Co.exeMD5
6d9ad19726c79c0f7b4bf91475452e2d
SHA1e6d92f05926c01ed146dbfdf02500c234ccf0888
SHA25637a30621364d3083424b24b0255fc8f5752d88c381600d840574e551c284fb6e
SHA51287923aeb9b0d409975dd0d364a6c12b57afffde944ccb6707cff134d456f6b8e9c1753b63ff7ffcbc0d389c37a1cff1cadc5075e4ecb503ebcabeb3f631b5eb3
-
C:\Windows\SysWOW64\Co.exeMD5
6d9ad19726c79c0f7b4bf91475452e2d
SHA1e6d92f05926c01ed146dbfdf02500c234ccf0888
SHA25637a30621364d3083424b24b0255fc8f5752d88c381600d840574e551c284fb6e
SHA51287923aeb9b0d409975dd0d364a6c12b57afffde944ccb6707cff134d456f6b8e9c1753b63ff7ffcbc0d389c37a1cff1cadc5075e4ecb503ebcabeb3f631b5eb3
-
\Users\Admin\AppData\Roaming\CoMD5
3206adc4d06bb764c9a4936c8e22708c
SHA1235e038f4feabb816150e2e1cf499fd300c3bd1a
SHA2568e31bb2d80682b758878488e1d17473f6ba7f37fb4469a4d67a0e600279e14b4
SHA512c6efad7c7fb7405690f2addb1f9713f4dacd3bfbfe074b0aec1b49473b8cfef62f3d1decbaf0bb093f674796ac75ed70b1f7b310af8509ae879e62fc3b126ea1
-
\Users\Admin\AppData\Roaming\CoMD5
3206adc4d06bb764c9a4936c8e22708c
SHA1235e038f4feabb816150e2e1cf499fd300c3bd1a
SHA2568e31bb2d80682b758878488e1d17473f6ba7f37fb4469a4d67a0e600279e14b4
SHA512c6efad7c7fb7405690f2addb1f9713f4dacd3bfbfe074b0aec1b49473b8cfef62f3d1decbaf0bb093f674796ac75ed70b1f7b310af8509ae879e62fc3b126ea1
-
memory/780-16-0x0000000000000000-mapping.dmp
-
memory/1268-10-0x0000000000000000-mapping.dmp
-
memory/1548-12-0x0000000000000000-mapping.dmp
-
memory/1584-15-0x0000000000000000-mapping.dmp
-
memory/1612-11-0x0000000000000000-mapping.dmp
-
memory/1688-8-0x0000000000000000-mapping.dmp
-
memory/1704-14-0x0000000000000000-mapping.dmp
-
memory/1712-13-0x0000000000000000-mapping.dmp
-
memory/1780-6-0x0000000000000000-mapping.dmp
-
memory/1788-17-0x0000000000000000-mapping.dmp
-
memory/1792-18-0x0000000000000000-mapping.dmp
-
memory/1848-4-0x0000000000000000-mapping.dmp
-
memory/1860-2-0x0000000000000000-mapping.dmp