Analysis
-
max time kernel
124s -
max time network
128s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:17
Static task
static1
Behavioral task
behavioral1
Sample
07b743dffd93be79b3ae4e8d5e0f05aec66af1115c4ec070df4cd35e800452d7.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
07b743dffd93be79b3ae4e8d5e0f05aec66af1115c4ec070df4cd35e800452d7.exe
Resource
win10v20201028
General
-
Target
07b743dffd93be79b3ae4e8d5e0f05aec66af1115c4ec070df4cd35e800452d7.exe
-
Size
91KB
-
MD5
5f6f945167ac81d4bd0e07705f4231c5
-
SHA1
6bbaf2c8ec7aa99247250ed6f55bff7719d75803
-
SHA256
07b743dffd93be79b3ae4e8d5e0f05aec66af1115c4ec070df4cd35e800452d7
-
SHA512
3b02cc77495263e96e550bdc9dc0bb56c0f9c2f4d639b65899f08d085a23437d80c20807fe27f719c91ed0bacc7763d113cef9767683cb15b485e25e297c87aa
Malware Config
Extracted
C:\29AC1-Readme.txt
netwalker
2Hamlampampom@cock.li
Galgalgalgalk@tutanota.com
Extracted
C:\Users\Admin\Documents\29AC1-Readme.txt
netwalker
2Hamlampampom@cock.li
Galgalgalgalk@tutanota.com
Extracted
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\29AC1-Readme.txt
netwalker
2Hamlampampom@cock.li
Galgalgalgalk@tutanota.com
Extracted
C:\Program Files\Microsoft Office\root\Office16\LogoImages\29AC1-Readme.txt
netwalker
2Hamlampampom@cock.li
Galgalgalgalk@tutanota.com
Signatures
-
Detected Netwalker Ransomware 2 IoCs
Detected unpacked Netwalker executable.
Processes:
resource yara_rule behavioral2/memory/4716-1-0x00000000003B0000-0x00000000003CB000-memory.dmp netwalker_ransomware behavioral2/memory/2116-3-0x00000000007F0000-0x000000000080B000-memory.dmp netwalker_ransomware -
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Deletes itself 1 IoCs
Processes:
explorer.exepid process 2116 explorer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\29ac139b = "C:\\Program Files (x86)\\29ac139b\\29ac139b.exe" explorer.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
07b743dffd93be79b3ae4e8d5e0f05aec66af1115c4ec070df4cd35e800452d7.exedescription pid process target process PID 4716 set thread context of 2116 4716 07b743dffd93be79b3ae4e8d5e0f05aec66af1115c4ec070df4cd35e800452d7.exe explorer.exe -
Drops file in Program Files directory 17200 IoCs
Processes:
explorer.exedescription ioc process File created C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\29AC1-Readme.txt explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-si\29AC1-Readme.txt explorer.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\29AC1-Readme.txt explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.News\Assets\news_button_over.png explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\5511_24x24x32.png explorer.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\vlc.mo explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\etc\visualvm.conf explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\Folder.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_2017.209.105.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-16.png explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\2875_48x48x32.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\SmallTile.scale-100.png explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\ui-strings.js explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon.png explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-pl.xrm-ms explorer.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-16_altform-unplated.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\themes_frame.png explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\pt-br\ui-strings.js explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\29AC1-Readme.txt explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.xml explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-dialogs_zh_CN.jar explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-phn.xrm-ms explorer.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe\Assets\contrast-white\Logo.scale-200_contrast-white.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\LargeTile.scale-200.png explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\createpdfupsell-app-selector.js explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\jvm.hprof.txt explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_fillandsign_18.svg explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\5601_48x48x32.png explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\6416_36x36x32.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\8.png explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_zh_4.4.0.v20140623020002.jar explorer.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe\Assets\contrast-black\Logo.scale-200_contrast-black.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Assets\Square71x71Logo.scale-200.png explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\Welcome.html explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-oob.xrm-ms explorer.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\29AC1-Readme.txt explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\us_60x42.png explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\29AC1-Readme.txt explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ja-jp\29AC1-Readme.txt explorer.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_zh_4.4.0.v20140623020002.jar explorer.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\ExchangeBadge.scale-200.png explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ppd.xrm-ms explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-60_altform-unplated.png explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sv_get.svg explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\hive.xsl explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\cc_60x42.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-black\SmallTile.scale-100.png explorer.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\29AC1-Readme.txt explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_scale-100.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteSmallTile.scale-125.png explorer.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-40_altform-unplated.png explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\eu-es\29AC1-Readme.txt explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\logo_retina.png explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pt-br\29AC1-Readme.txt explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-20_altform-unplated_contrast-white.png explorer.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\heart.png explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-oob.xrm-ms explorer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\29AC1-Readme.txt explorer.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\de-de\ui-strings.js explorer.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\WPFT632.CNV explorer.exe -
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exevssadmin.exepid process 4220 vssadmin.exe 3188 vssadmin.exe 8132 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 23523 IoCs
Processes:
explorer.exeexplorer.exepid process 2116 explorer.exe 2116 explorer.exe 2116 explorer.exe 2116 explorer.exe 2116 explorer.exe 2116 explorer.exe 2116 explorer.exe 2116 explorer.exe 2116 explorer.exe 2116 explorer.exe 2116 explorer.exe 2116 explorer.exe 2116 explorer.exe 2116 explorer.exe 2116 explorer.exe 2116 explorer.exe 2116 explorer.exe 2116 explorer.exe 2116 explorer.exe 2116 explorer.exe 2116 explorer.exe 2116 explorer.exe 2116 explorer.exe 2116 explorer.exe 2116 explorer.exe 2116 explorer.exe 2116 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe 4244 explorer.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
07b743dffd93be79b3ae4e8d5e0f05aec66af1115c4ec070df4cd35e800452d7.exeexplorer.exepid process 4716 07b743dffd93be79b3ae4e8d5e0f05aec66af1115c4ec070df4cd35e800452d7.exe 2116 explorer.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
explorer.exevssvc.exeexplorer.exedescription pid process Token: SeDebugPrivilege 2116 explorer.exe Token: SeBackupPrivilege 4168 vssvc.exe Token: SeRestorePrivilege 4168 vssvc.exe Token: SeAuditPrivilege 4168 vssvc.exe Token: SeDebugPrivilege 4244 explorer.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
07b743dffd93be79b3ae4e8d5e0f05aec66af1115c4ec070df4cd35e800452d7.exeexplorer.exeexplorer.exedescription pid process target process PID 4716 wrote to memory of 2116 4716 07b743dffd93be79b3ae4e8d5e0f05aec66af1115c4ec070df4cd35e800452d7.exe explorer.exe PID 4716 wrote to memory of 2116 4716 07b743dffd93be79b3ae4e8d5e0f05aec66af1115c4ec070df4cd35e800452d7.exe explorer.exe PID 4716 wrote to memory of 2116 4716 07b743dffd93be79b3ae4e8d5e0f05aec66af1115c4ec070df4cd35e800452d7.exe explorer.exe PID 2116 wrote to memory of 4220 2116 explorer.exe vssadmin.exe PID 2116 wrote to memory of 4220 2116 explorer.exe vssadmin.exe PID 2116 wrote to memory of 4244 2116 explorer.exe explorer.exe PID 2116 wrote to memory of 4244 2116 explorer.exe explorer.exe PID 2116 wrote to memory of 4244 2116 explorer.exe explorer.exe PID 4244 wrote to memory of 3188 4244 explorer.exe vssadmin.exe PID 4244 wrote to memory of 3188 4244 explorer.exe vssadmin.exe PID 2116 wrote to memory of 5284 2116 explorer.exe notepad.exe PID 2116 wrote to memory of 5284 2116 explorer.exe notepad.exe PID 2116 wrote to memory of 5284 2116 explorer.exe notepad.exe PID 2116 wrote to memory of 8132 2116 explorer.exe vssadmin.exe PID 2116 wrote to memory of 8132 2116 explorer.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\07b743dffd93be79b3ae4e8d5e0f05aec66af1115c4ec070df4cd35e800452d7.exe"C:\Users\Admin\AppData\Local\Temp\07b743dffd93be79b3ae4e8d5e0f05aec66af1115c4ec070df4cd35e800452d7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"2⤵
- Deletes itself
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\system32\notepad.exe C:\Users\Admin\Desktop\29AC1-Readme.txt3⤵
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\29AC1-Readme.txtMD5
e4235d730b016617c60a6bef9e2b3df1
SHA1222d5a10e82fc9c62131f5c740f684963d8d36e4
SHA2568443c4f6e9543490541bf2977066369ff2d84a5ebe590790d2838a1d50cdb222
SHA512dc3c129742a6e3e4a9ec3b6caeacd7aa2b83bce2962aab5cbca48228c236eb2f0f88e10b5eff06bd4894c2c71e8ef5741ac61056e4df1bb92dae6f03eba2a221
-
memory/2116-0-0x0000000000000000-mapping.dmp
-
memory/2116-3-0x00000000007F0000-0x000000000080B000-memory.dmpFilesize
108KB
-
memory/3188-5-0x0000000000000000-mapping.dmp
-
memory/4220-2-0x0000000000000000-mapping.dmp
-
memory/4244-4-0x0000000000000000-mapping.dmp
-
memory/4716-1-0x00000000003B0000-0x00000000003CB000-memory.dmpFilesize
108KB
-
memory/5284-6-0x0000000000000000-mapping.dmp
-
memory/8132-7-0x0000000000000000-mapping.dmp