Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
06-12-2020 10:49
Static task
static1
Behavioral task
behavioral1
Sample
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
-
Size
473KB
-
MD5
f83fb9ce6a83da58b20685c1d7e1e546
-
SHA1
01c459b549c1c2a68208d38d4ba5e36d29212a4f
-
SHA256
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684
-
SHA512
934ec9073a28b90e8df785bef49f224789da59f83729208b92dba0503e2894b3f48ed04b20de1ba49374b1cd26f0c87e8e5ab79e817258135e3be2c171f3f396
Score
10/10
Malware Config
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exedescription ioc Process File renamed C:\Users\Admin\Pictures\UnprotectPush.crw => C:\Users\Admin\Pictures\UnprotectPush.crw.nXaBF e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe File renamed C:\Users\Admin\Pictures\ClearRename.tif => C:\Users\Admin\Pictures\ClearRename.tif.DHbVds e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe File renamed C:\Users\Admin\Pictures\GrantSave.png => C:\Users\Admin\Pictures\GrantSave.png.E0RsspK e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe File renamed C:\Users\Admin\Pictures\JoinEdit.png => C:\Users\Admin\Pictures\JoinEdit.png.E0RsspK e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe File renamed C:\Users\Admin\Pictures\TestUnprotect.png => C:\Users\Admin\Pictures\TestUnprotect.png.skROx e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe -
Drops startup file 2 IoCs
Processes:
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.html e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1hxjt1so.dat e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\123456789.bmp" e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exepid Process 596 e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe -
Suspicious use of AdjustPrivilegeToken 83 IoCs
Processes:
wmic.exevssvc.exewmic.exedescription pid Process Token: SeIncreaseQuotaPrivilege 1548 wmic.exe Token: SeSecurityPrivilege 1548 wmic.exe Token: SeTakeOwnershipPrivilege 1548 wmic.exe Token: SeLoadDriverPrivilege 1548 wmic.exe Token: SeSystemProfilePrivilege 1548 wmic.exe Token: SeSystemtimePrivilege 1548 wmic.exe Token: SeProfSingleProcessPrivilege 1548 wmic.exe Token: SeIncBasePriorityPrivilege 1548 wmic.exe Token: SeCreatePagefilePrivilege 1548 wmic.exe Token: SeBackupPrivilege 1548 wmic.exe Token: SeRestorePrivilege 1548 wmic.exe Token: SeShutdownPrivilege 1548 wmic.exe Token: SeDebugPrivilege 1548 wmic.exe Token: SeSystemEnvironmentPrivilege 1548 wmic.exe Token: SeRemoteShutdownPrivilege 1548 wmic.exe Token: SeUndockPrivilege 1548 wmic.exe Token: SeManageVolumePrivilege 1548 wmic.exe Token: 33 1548 wmic.exe Token: 34 1548 wmic.exe Token: 35 1548 wmic.exe Token: SeIncreaseQuotaPrivilege 1548 wmic.exe Token: SeSecurityPrivilege 1548 wmic.exe Token: SeTakeOwnershipPrivilege 1548 wmic.exe Token: SeLoadDriverPrivilege 1548 wmic.exe Token: SeSystemProfilePrivilege 1548 wmic.exe Token: SeSystemtimePrivilege 1548 wmic.exe Token: SeProfSingleProcessPrivilege 1548 wmic.exe Token: SeIncBasePriorityPrivilege 1548 wmic.exe Token: SeCreatePagefilePrivilege 1548 wmic.exe Token: SeBackupPrivilege 1548 wmic.exe Token: SeRestorePrivilege 1548 wmic.exe Token: SeShutdownPrivilege 1548 wmic.exe Token: SeDebugPrivilege 1548 wmic.exe Token: SeSystemEnvironmentPrivilege 1548 wmic.exe Token: SeRemoteShutdownPrivilege 1548 wmic.exe Token: SeUndockPrivilege 1548 wmic.exe Token: SeManageVolumePrivilege 1548 wmic.exe Token: 33 1548 wmic.exe Token: 34 1548 wmic.exe Token: 35 1548 wmic.exe Token: SeBackupPrivilege 1496 vssvc.exe Token: SeRestorePrivilege 1496 vssvc.exe Token: SeAuditPrivilege 1496 vssvc.exe Token: SeIncreaseQuotaPrivilege 1640 wmic.exe Token: SeSecurityPrivilege 1640 wmic.exe Token: SeTakeOwnershipPrivilege 1640 wmic.exe Token: SeLoadDriverPrivilege 1640 wmic.exe Token: SeSystemProfilePrivilege 1640 wmic.exe Token: SeSystemtimePrivilege 1640 wmic.exe Token: SeProfSingleProcessPrivilege 1640 wmic.exe Token: SeIncBasePriorityPrivilege 1640 wmic.exe Token: SeCreatePagefilePrivilege 1640 wmic.exe Token: SeBackupPrivilege 1640 wmic.exe Token: SeRestorePrivilege 1640 wmic.exe Token: SeShutdownPrivilege 1640 wmic.exe Token: SeDebugPrivilege 1640 wmic.exe Token: SeSystemEnvironmentPrivilege 1640 wmic.exe Token: SeRemoteShutdownPrivilege 1640 wmic.exe Token: SeUndockPrivilege 1640 wmic.exe Token: SeManageVolumePrivilege 1640 wmic.exe Token: 33 1640 wmic.exe Token: 34 1640 wmic.exe Token: 35 1640 wmic.exe Token: SeIncreaseQuotaPrivilege 1640 wmic.exe Token: SeSecurityPrivilege 1640 wmic.exe Token: SeTakeOwnershipPrivilege 1640 wmic.exe Token: SeLoadDriverPrivilege 1640 wmic.exe Token: SeSystemProfilePrivilege 1640 wmic.exe Token: SeSystemtimePrivilege 1640 wmic.exe Token: SeProfSingleProcessPrivilege 1640 wmic.exe Token: SeIncBasePriorityPrivilege 1640 wmic.exe Token: SeCreatePagefilePrivilege 1640 wmic.exe Token: SeBackupPrivilege 1640 wmic.exe Token: SeRestorePrivilege 1640 wmic.exe Token: SeShutdownPrivilege 1640 wmic.exe Token: SeDebugPrivilege 1640 wmic.exe Token: SeSystemEnvironmentPrivilege 1640 wmic.exe Token: SeRemoteShutdownPrivilege 1640 wmic.exe Token: SeUndockPrivilege 1640 wmic.exe Token: SeManageVolumePrivilege 1640 wmic.exe Token: 33 1640 wmic.exe Token: 34 1640 wmic.exe Token: 35 1640 wmic.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exedescription pid Process procid_target PID 596 wrote to memory of 1548 596 e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe 29 PID 596 wrote to memory of 1548 596 e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe 29 PID 596 wrote to memory of 1548 596 e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe 29 PID 596 wrote to memory of 1548 596 e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe 29 PID 596 wrote to memory of 1640 596 e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe 35 PID 596 wrote to memory of 1640 596 e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe 35 PID 596 wrote to memory of 1640 596 e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe 35 PID 596 wrote to memory of 1640 596 e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe"C:\Users\Admin\AppData\Local\Temp\e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Windows\system32\wbem\wmic.exe"C:\jvg\..\Windows\hkt\..\system32\h\xnn\nvmy\..\..\..\wbem\upnm\oxuqp\gb\..\..\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1548
-
-
C:\Windows\system32\wbem\wmic.exe"C:\ans\d\gsjtp\..\..\..\Windows\ptg\he\..\..\system32\ej\b\..\..\wbem\kbpv\cf\..\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1640
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1496
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵PID:1608