Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 20:17
Static task
static1
Behavioral task
behavioral1
Sample
bde6a59a4611aba5862ce66aef2fb12d841ad0ba0ad0a590b26eaddb7ad52a9e.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
bde6a59a4611aba5862ce66aef2fb12d841ad0ba0ad0a590b26eaddb7ad52a9e.exe
Resource
win10v20201028
General
-
Target
bde6a59a4611aba5862ce66aef2fb12d841ad0ba0ad0a590b26eaddb7ad52a9e.exe
-
Size
92KB
-
MD5
51b3c42e1c5c8d736d934af459204471
-
SHA1
db4084bfee8902fd025c31f0cfea7b2ee52e5e70
-
SHA256
bde6a59a4611aba5862ce66aef2fb12d841ad0ba0ad0a590b26eaddb7ad52a9e
-
SHA512
75cb47ab16f48a35bf8825c61c259e3392bde93dd993556fa9167dd096d8f635374cfafe886aec84056aceaf0b8fabb5122d09f871b9f093282bb0902a5c5178
Malware Config
Extracted
C:\ProgramData\Microsoft\User Account Pictures\553E0-Readme.txt
netwalker
sevenoneone@cock.li
kavariusing@tutanota.com
Extracted
C:\Users\Admin\Desktop\553E0-Readme.txt
netwalker
sevenoneone@cock.li
kavariusing@tutanota.com
Signatures
-
Detected Netwalker Ransomware 2 IoCs
Detected unpacked Netwalker executable.
Processes:
resource yara_rule behavioral1/memory/1360-1-0x00000000000E0000-0x00000000000FB000-memory.dmp netwalker_ransomware behavioral1/memory/1748-4-0x00000000001F0000-0x000000000020B000-memory.dmp netwalker_ransomware -
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
explorer.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\DenyLock.tiff explorer.exe File opened for modification C:\Users\Admin\Pictures\InvokeRename.tiff explorer.exe File opened for modification C:\Users\Admin\Pictures\PushSet.tiff explorer.exe File opened for modification C:\Users\Admin\Pictures\RestoreApprove.tiff explorer.exe -
Deletes itself 1 IoCs
Processes:
explorer.exepid process 1748 explorer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\553e08ac = "C:\\Program Files (x86)\\553e08ac\\553e08ac.exe" explorer.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
bde6a59a4611aba5862ce66aef2fb12d841ad0ba0ad0a590b26eaddb7ad52a9e.exeexplorer.exedescription pid process target process PID 1360 set thread context of 1748 1360 bde6a59a4611aba5862ce66aef2fb12d841ad0ba0ad0a590b26eaddb7ad52a9e.exe explorer.exe PID 1748 set thread context of 872 1748 explorer.exe explorer.exe -
Drops file in Program Files directory 7489 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\CLICK.WAV explorer.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\553E0-Readme.txt explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-spi-actions.jar explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santa_Isabel explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\AIR98.POC explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\POSTIT.CFG explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectToolsetIconImages.jpg explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui_5.5.0.165303.jar explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382944.JPG explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\FLASH.NET.XML explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbynet.jar explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.properties explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107734.WMF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00170_.WMF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\QUERIES\MSN MoneyCentral Investor Major Indicies.iqy explorer.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\553E0-Readme.txt explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-util-enumerations.xml_hidden explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLOOK.DEV.HXS explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImageSmall.jpg explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsFormTemplateRTL.html explorer.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Gibraltar explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSPUB_K_COL.HXK explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Monticello explorer.exe File opened for modification C:\Program Files\CompareDisable.mht explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange.css explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\epl-v10.html explorer.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Rio_Branco explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099205.WMF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01568_.WMF explorer.exe File created C:\Program Files\VideoLAN\VLC\skins\fonts\553E0-Readme.txt explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EADOCUMENTAPPROVAL_REVIEW.XSN explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PSSKETLG.WMF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\EXITEM.CFG explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\MLA.XSL explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Concourse.xml explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core.xml explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18210_.WMF explorer.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\553E0-Readme.txt explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0200189.WMF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSSP7EN.dub explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00444_.WMF explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-dialogs.xml explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Opulent.thmx explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMANIAN.TXT explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0216588.WMF explorer.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\553E0-Readme.txt explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00267_.WMF explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar explorer.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Gambier explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Beulah explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Casual.css explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME13.CSS explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185806.WMF explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\WARN.WAV explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\TAB_ON.GIF explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\MANIFEST.MF explorer.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGPUNCT.XML explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Porto_Velho explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt explorer.exe -
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exevssadmin.exepid process 1768 vssadmin.exe 1832 vssadmin.exe 5468 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 16452 IoCs
Processes:
explorer.exeexplorer.exepid process 1748 explorer.exe 1748 explorer.exe 1748 explorer.exe 1748 explorer.exe 1748 explorer.exe 1748 explorer.exe 1748 explorer.exe 1748 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe 872 explorer.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
bde6a59a4611aba5862ce66aef2fb12d841ad0ba0ad0a590b26eaddb7ad52a9e.exeexplorer.exepid process 1360 bde6a59a4611aba5862ce66aef2fb12d841ad0ba0ad0a590b26eaddb7ad52a9e.exe 1748 explorer.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
explorer.exeexplorer.exevssvc.exedescription pid process Token: SeDebugPrivilege 1748 explorer.exe Token: SeDebugPrivilege 872 explorer.exe Token: SeBackupPrivilege 1992 vssvc.exe Token: SeRestorePrivilege 1992 vssvc.exe Token: SeAuditPrivilege 1992 vssvc.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
bde6a59a4611aba5862ce66aef2fb12d841ad0ba0ad0a590b26eaddb7ad52a9e.exeexplorer.exeexplorer.exedescription pid process target process PID 1360 wrote to memory of 1748 1360 bde6a59a4611aba5862ce66aef2fb12d841ad0ba0ad0a590b26eaddb7ad52a9e.exe explorer.exe PID 1360 wrote to memory of 1748 1360 bde6a59a4611aba5862ce66aef2fb12d841ad0ba0ad0a590b26eaddb7ad52a9e.exe explorer.exe PID 1360 wrote to memory of 1748 1360 bde6a59a4611aba5862ce66aef2fb12d841ad0ba0ad0a590b26eaddb7ad52a9e.exe explorer.exe PID 1360 wrote to memory of 1748 1360 bde6a59a4611aba5862ce66aef2fb12d841ad0ba0ad0a590b26eaddb7ad52a9e.exe explorer.exe PID 1748 wrote to memory of 1768 1748 explorer.exe vssadmin.exe PID 1748 wrote to memory of 1768 1748 explorer.exe vssadmin.exe PID 1748 wrote to memory of 1768 1748 explorer.exe vssadmin.exe PID 1748 wrote to memory of 1768 1748 explorer.exe vssadmin.exe PID 1748 wrote to memory of 872 1748 explorer.exe explorer.exe PID 1748 wrote to memory of 872 1748 explorer.exe explorer.exe PID 1748 wrote to memory of 872 1748 explorer.exe explorer.exe PID 1748 wrote to memory of 872 1748 explorer.exe explorer.exe PID 872 wrote to memory of 1832 872 explorer.exe vssadmin.exe PID 872 wrote to memory of 1832 872 explorer.exe vssadmin.exe PID 872 wrote to memory of 1832 872 explorer.exe vssadmin.exe PID 872 wrote to memory of 1832 872 explorer.exe vssadmin.exe PID 1748 wrote to memory of 6972 1748 explorer.exe notepad.exe PID 1748 wrote to memory of 6972 1748 explorer.exe notepad.exe PID 1748 wrote to memory of 6972 1748 explorer.exe notepad.exe PID 1748 wrote to memory of 6972 1748 explorer.exe notepad.exe PID 1748 wrote to memory of 5468 1748 explorer.exe vssadmin.exe PID 1748 wrote to memory of 5468 1748 explorer.exe vssadmin.exe PID 1748 wrote to memory of 5468 1748 explorer.exe vssadmin.exe PID 1748 wrote to memory of 5468 1748 explorer.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bde6a59a4611aba5862ce66aef2fb12d841ad0ba0ad0a590b26eaddb7ad52a9e.exe"C:\Users\Admin\AppData\Local\Temp\bde6a59a4611aba5862ce66aef2fb12d841ad0ba0ad0a590b26eaddb7ad52a9e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"2⤵
- Modifies extensions of user files
- Deletes itself
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe "C:\Users\Admin\Desktop\553E0-Readme.txt"3⤵
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\553E0-Readme.txtMD5
e76ae54e01723c3585e3a2036dfaf7d9
SHA1ee0ed1c81109a0f56ad4f5017f6e6415f0339af1
SHA2565b94a55c871465b8e54ef05db54628adc9ebafbd927cc9b1a15fe1cec3651ed8
SHA51232e4231a2d95fba41d75c7c02f3495070b63adcfb5320faec59209f63dfd733244ce93a71c0670bb1816adf45a245b3e8827f934555a88515ccc45b1276f19bf
-
memory/872-3-0x0000000000000000-mapping.dmp
-
memory/1360-1-0x00000000000E0000-0x00000000000FB000-memory.dmpFilesize
108KB
-
memory/1748-0-0x0000000000000000-mapping.dmp
-
memory/1748-4-0x00000000001F0000-0x000000000020B000-memory.dmpFilesize
108KB
-
memory/1768-2-0x0000000000000000-mapping.dmp
-
memory/1832-5-0x0000000000000000-mapping.dmp
-
memory/5468-7-0x0000000000000000-mapping.dmp
-
memory/6972-6-0x0000000000000000-mapping.dmp