Analysis
-
max time kernel
134s -
max time network
136s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
03-11-2020 14:20
Static task
static1
Behavioral task
behavioral1
Sample
ec9b412e9a6e0da1a21c01158c4c8313b61b033f58d16d913d72229794069d18.bin.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
ec9b412e9a6e0da1a21c01158c4c8313b61b033f58d16d913d72229794069d18.bin.exe
Resource
win10v20201028
General
-
Target
ec9b412e9a6e0da1a21c01158c4c8313b61b033f58d16d913d72229794069d18.bin.exe
-
Size
58KB
-
MD5
69b2e5d45b9eb9b7d342f6f580dd6ba8
-
SHA1
6005c62f68ab4541e4d285d5e20877904b08fc48
-
SHA256
ec9b412e9a6e0da1a21c01158c4c8313b61b033f58d16d913d72229794069d18
-
SHA512
511d47ebbc55fa612ef8755446b835079bb6c09c22fe6987ed9170a1efabc2f5ada0e9f801899e5f315401aa8d4408e0883f34d8d4fbd6dcf944a6b99e0af430
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
Processes:
Snmp:binSnmp.exepid process 2016 Snmp:bin 1524 Snmp.exe -
Modifies extensions of user files 21 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
Snmp.exedescription ioc process File created C:\Users\Admin\Pictures\CloseNew.crw.3ncrypt3d_help Snmp.exe File opened for modification C:\Users\Admin\Pictures\ResizeDisable.png.3ncrypt3d Snmp.exe File renamed C:\Users\Admin\Pictures\ResumeHide.crw => C:\Users\Admin\Pictures\ResumeHide.crw.3ncrypt3d Snmp.exe File created C:\Users\Admin\Pictures\UndoBackup.png.3ncrypt3d_help Snmp.exe File renamed C:\Users\Admin\Pictures\UndoBackup.png => C:\Users\Admin\Pictures\UndoBackup.png.3ncrypt3d Snmp.exe File opened for modification C:\Users\Admin\Pictures\UndoBackup.png.3ncrypt3d Snmp.exe File created C:\Users\Admin\Pictures\UnlockSuspend.tif.3ncrypt3d_help Snmp.exe File renamed C:\Users\Admin\Pictures\UnlockSuspend.tif => C:\Users\Admin\Pictures\UnlockSuspend.tif.3ncrypt3d Snmp.exe File renamed C:\Users\Admin\Pictures\ExitSet.tiff => C:\Users\Admin\Pictures\ExitSet.tiff.3ncrypt3d Snmp.exe File created C:\Users\Admin\Pictures\RedoPublish.crw.3ncrypt3d_help Snmp.exe File opened for modification C:\Users\Admin\Pictures\RedoPublish.crw.3ncrypt3d Snmp.exe File renamed C:\Users\Admin\Pictures\CloseNew.crw => C:\Users\Admin\Pictures\CloseNew.crw.3ncrypt3d Snmp.exe File opened for modification C:\Users\Admin\Pictures\CloseNew.crw.3ncrypt3d Snmp.exe File created C:\Users\Admin\Pictures\ExitSet.tiff.3ncrypt3d_help Snmp.exe File opened for modification C:\Users\Admin\Pictures\ExitSet.tiff.3ncrypt3d Snmp.exe File renamed C:\Users\Admin\Pictures\ResizeDisable.png => C:\Users\Admin\Pictures\ResizeDisable.png.3ncrypt3d Snmp.exe File opened for modification C:\Users\Admin\Pictures\ResumeHide.crw.3ncrypt3d Snmp.exe File opened for modification C:\Users\Admin\Pictures\UnlockSuspend.tif.3ncrypt3d Snmp.exe File renamed C:\Users\Admin\Pictures\RedoPublish.crw => C:\Users\Admin\Pictures\RedoPublish.crw.3ncrypt3d Snmp.exe File created C:\Users\Admin\Pictures\ResizeDisable.png.3ncrypt3d_help Snmp.exe File created C:\Users\Admin\Pictures\ResumeHide.crw.3ncrypt3d_help Snmp.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 1368 takeown.exe 1528 icacls.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 584 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
ec9b412e9a6e0da1a21c01158c4c8313b61b033f58d16d913d72229794069d18.bin.exepid process 484 ec9b412e9a6e0da1a21c01158c4c8313b61b033f58d16d913d72229794069d18.bin.exe 484 ec9b412e9a6e0da1a21c01158c4c8313b61b033f58d16d913d72229794069d18.bin.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 1368 takeown.exe 1528 icacls.exe -
Drops file in System32 directory 2 IoCs
Processes:
Snmp:binattrib.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Snmp.exe Snmp:bin File opened for modification C:\Windows\SysWOW64\Snmp.exe attrib.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1420 vssadmin.exe -
NTFS ADS 1 IoCs
Processes:
ec9b412e9a6e0da1a21c01158c4c8313b61b033f58d16d913d72229794069d18.bin.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Snmp:bin ec9b412e9a6e0da1a21c01158c4c8313b61b033f58d16d913d72229794069d18.bin.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 2012 vssvc.exe Token: SeRestorePrivilege 2012 vssvc.exe Token: SeAuditPrivilege 2012 vssvc.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
ec9b412e9a6e0da1a21c01158c4c8313b61b033f58d16d913d72229794069d18.bin.exeSnmp:binSnmp.execmd.execmd.execmd.exedescription pid process target process PID 484 wrote to memory of 2016 484 ec9b412e9a6e0da1a21c01158c4c8313b61b033f58d16d913d72229794069d18.bin.exe Snmp:bin PID 484 wrote to memory of 2016 484 ec9b412e9a6e0da1a21c01158c4c8313b61b033f58d16d913d72229794069d18.bin.exe Snmp:bin PID 484 wrote to memory of 2016 484 ec9b412e9a6e0da1a21c01158c4c8313b61b033f58d16d913d72229794069d18.bin.exe Snmp:bin PID 484 wrote to memory of 2016 484 ec9b412e9a6e0da1a21c01158c4c8313b61b033f58d16d913d72229794069d18.bin.exe Snmp:bin PID 2016 wrote to memory of 1420 2016 Snmp:bin vssadmin.exe PID 2016 wrote to memory of 1420 2016 Snmp:bin vssadmin.exe PID 2016 wrote to memory of 1420 2016 Snmp:bin vssadmin.exe PID 2016 wrote to memory of 1420 2016 Snmp:bin vssadmin.exe PID 2016 wrote to memory of 1368 2016 Snmp:bin takeown.exe PID 2016 wrote to memory of 1368 2016 Snmp:bin takeown.exe PID 2016 wrote to memory of 1368 2016 Snmp:bin takeown.exe PID 2016 wrote to memory of 1368 2016 Snmp:bin takeown.exe PID 2016 wrote to memory of 1528 2016 Snmp:bin icacls.exe PID 2016 wrote to memory of 1528 2016 Snmp:bin icacls.exe PID 2016 wrote to memory of 1528 2016 Snmp:bin icacls.exe PID 2016 wrote to memory of 1528 2016 Snmp:bin icacls.exe PID 1524 wrote to memory of 332 1524 Snmp.exe cmd.exe PID 1524 wrote to memory of 332 1524 Snmp.exe cmd.exe PID 1524 wrote to memory of 332 1524 Snmp.exe cmd.exe PID 1524 wrote to memory of 332 1524 Snmp.exe cmd.exe PID 332 wrote to memory of 916 332 cmd.exe choice.exe PID 332 wrote to memory of 916 332 cmd.exe choice.exe PID 332 wrote to memory of 916 332 cmd.exe choice.exe PID 332 wrote to memory of 916 332 cmd.exe choice.exe PID 2016 wrote to memory of 300 2016 Snmp:bin cmd.exe PID 2016 wrote to memory of 300 2016 Snmp:bin cmd.exe PID 2016 wrote to memory of 300 2016 Snmp:bin cmd.exe PID 2016 wrote to memory of 300 2016 Snmp:bin cmd.exe PID 484 wrote to memory of 584 484 ec9b412e9a6e0da1a21c01158c4c8313b61b033f58d16d913d72229794069d18.bin.exe cmd.exe PID 484 wrote to memory of 584 484 ec9b412e9a6e0da1a21c01158c4c8313b61b033f58d16d913d72229794069d18.bin.exe cmd.exe PID 484 wrote to memory of 584 484 ec9b412e9a6e0da1a21c01158c4c8313b61b033f58d16d913d72229794069d18.bin.exe cmd.exe PID 484 wrote to memory of 584 484 ec9b412e9a6e0da1a21c01158c4c8313b61b033f58d16d913d72229794069d18.bin.exe cmd.exe PID 300 wrote to memory of 1556 300 cmd.exe choice.exe PID 300 wrote to memory of 1556 300 cmd.exe choice.exe PID 300 wrote to memory of 1556 300 cmd.exe choice.exe PID 300 wrote to memory of 1556 300 cmd.exe choice.exe PID 584 wrote to memory of 2008 584 cmd.exe choice.exe PID 584 wrote to memory of 2008 584 cmd.exe choice.exe PID 584 wrote to memory of 2008 584 cmd.exe choice.exe PID 584 wrote to memory of 2008 584 cmd.exe choice.exe PID 332 wrote to memory of 1344 332 cmd.exe attrib.exe PID 332 wrote to memory of 1344 332 cmd.exe attrib.exe PID 332 wrote to memory of 1344 332 cmd.exe attrib.exe PID 332 wrote to memory of 1344 332 cmd.exe attrib.exe PID 584 wrote to memory of 1684 584 cmd.exe attrib.exe PID 584 wrote to memory of 1684 584 cmd.exe attrib.exe PID 584 wrote to memory of 1684 584 cmd.exe attrib.exe PID 584 wrote to memory of 1684 584 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1344 attrib.exe 1684 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec9b412e9a6e0da1a21c01158c4c8313b61b033f58d16d913d72229794069d18.bin.exe"C:\Users\Admin\AppData\Local\Temp\ec9b412e9a6e0da1a21c01158c4c8313b61b033f58d16d913d72229794069d18.bin.exe"1⤵
- Loads dropped DLL
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Snmp:binC:\Users\Admin\AppData\Roaming\Snmp:bin -r2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\takeown.exeC:\Windows\system32\takeown.exe /F C:\Windows\system32\Snmp.exe3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exeC:\Windows\system32\icacls.exe C:\Windows\system32\Snmp.exe /reset3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd /c choice /d y /t 11 & attrib -h "C:\Users\Admin\AppData\Roaming\Snmp" & del "C:\Users\Admin\AppData\Roaming\Snmp"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /d y /t 114⤵
-
C:\Windows\SysWOW64\cmd.execmd /c choice /d y /t 11 & attrib -h "C:\Users\Admin\AppData\Local\Temp\ec9b412e9a6e0da1a21c01158c4c8313b61b033f58d16d913d72229794069d18.bin.exe" & del "C:\Users\Admin\AppData\Local\Temp\ec9b412e9a6e0da1a21c01158c4c8313b61b033f58d16d913d72229794069d18.bin.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /d y /t 113⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Local\Temp\ec9b412e9a6e0da1a21c01158c4c8313b61b033f58d16d913d72229794069d18.bin.exe"3⤵
- Views/modifies file attributes
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Snmp.exeC:\Windows\SysWOW64\Snmp.exe -s1⤵
- Executes dropped EXE
- Modifies extensions of user files
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c choice /d y /t 11 & attrib -h "C:\Windows\SysWOW64\Snmp.exe" & del "C:\Windows\SysWOW64\Snmp.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /d y /t 113⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Windows\SysWOW64\Snmp.exe"3⤵
- Drops file in System32 directory
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Snmp:binMD5
69b2e5d45b9eb9b7d342f6f580dd6ba8
SHA16005c62f68ab4541e4d285d5e20877904b08fc48
SHA256ec9b412e9a6e0da1a21c01158c4c8313b61b033f58d16d913d72229794069d18
SHA512511d47ebbc55fa612ef8755446b835079bb6c09c22fe6987ed9170a1efabc2f5ada0e9f801899e5f315401aa8d4408e0883f34d8d4fbd6dcf944a6b99e0af430
-
C:\Users\Admin\AppData\Roaming\Snmp:binMD5
69b2e5d45b9eb9b7d342f6f580dd6ba8
SHA16005c62f68ab4541e4d285d5e20877904b08fc48
SHA256ec9b412e9a6e0da1a21c01158c4c8313b61b033f58d16d913d72229794069d18
SHA512511d47ebbc55fa612ef8755446b835079bb6c09c22fe6987ed9170a1efabc2f5ada0e9f801899e5f315401aa8d4408e0883f34d8d4fbd6dcf944a6b99e0af430
-
C:\Windows\SysWOW64\Snmp.exeMD5
69b2e5d45b9eb9b7d342f6f580dd6ba8
SHA16005c62f68ab4541e4d285d5e20877904b08fc48
SHA256ec9b412e9a6e0da1a21c01158c4c8313b61b033f58d16d913d72229794069d18
SHA512511d47ebbc55fa612ef8755446b835079bb6c09c22fe6987ed9170a1efabc2f5ada0e9f801899e5f315401aa8d4408e0883f34d8d4fbd6dcf944a6b99e0af430
-
C:\Windows\SysWOW64\Snmp.exeMD5
69b2e5d45b9eb9b7d342f6f580dd6ba8
SHA16005c62f68ab4541e4d285d5e20877904b08fc48
SHA256ec9b412e9a6e0da1a21c01158c4c8313b61b033f58d16d913d72229794069d18
SHA512511d47ebbc55fa612ef8755446b835079bb6c09c22fe6987ed9170a1efabc2f5ada0e9f801899e5f315401aa8d4408e0883f34d8d4fbd6dcf944a6b99e0af430
-
\Users\Admin\AppData\Roaming\SnmpMD5
94feb4417cf3e39c8c58a1b73620687e
SHA1ea03ac74ff1f49f93445781c90d5518f5e5d9cab
SHA2561caa06ba419a05129a54e085aa80aa8bbe533c7276574036f75627c421cc436d
SHA512ef1fe9201b915fb5d551c09b59846408c3ed27e5a6e832f732a521808970526a16e926b9585051d7705f363aa021ac4f087ac508c7cdf5130eb8ead77dd867d5
-
\Users\Admin\AppData\Roaming\SnmpMD5
94feb4417cf3e39c8c58a1b73620687e
SHA1ea03ac74ff1f49f93445781c90d5518f5e5d9cab
SHA2561caa06ba419a05129a54e085aa80aa8bbe533c7276574036f75627c421cc436d
SHA512ef1fe9201b915fb5d551c09b59846408c3ed27e5a6e832f732a521808970526a16e926b9585051d7705f363aa021ac4f087ac508c7cdf5130eb8ead77dd867d5
-
memory/300-12-0x0000000000000000-mapping.dmp
-
memory/332-10-0x0000000000000000-mapping.dmp
-
memory/584-13-0x0000000000000000-mapping.dmp
-
memory/916-11-0x0000000000000000-mapping.dmp
-
memory/1344-16-0x0000000000000000-mapping.dmp
-
memory/1368-6-0x0000000000000000-mapping.dmp
-
memory/1420-4-0x0000000000000000-mapping.dmp
-
memory/1528-8-0x0000000000000000-mapping.dmp
-
memory/1556-14-0x0000000000000000-mapping.dmp
-
memory/1684-17-0x0000000000000000-mapping.dmp
-
memory/2008-15-0x0000000000000000-mapping.dmp
-
memory/2016-2-0x0000000000000000-mapping.dmp