Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
07-12-2020 19:31
Static task
static1
Behavioral task
behavioral1
Sample
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe
-
Size
473KB
-
MD5
f83fb9ce6a83da58b20685c1d7e1e546
-
SHA1
01c459b549c1c2a68208d38d4ba5e36d29212a4f
-
SHA256
e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684
-
SHA512
934ec9073a28b90e8df785bef49f224789da59f83729208b92dba0503e2894b3f48ed04b20de1ba49374b1cd26f0c87e8e5ab79e817258135e3be2c171f3f396
Score
10/10
Malware Config
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ClearUnpublish.crw => C:\Users\Admin\Pictures\ClearUnpublish.crw.RySld e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe File renamed C:\Users\Admin\Pictures\CloseComplete.raw => C:\Users\Admin\Pictures\CloseComplete.raw.RySld e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe File renamed C:\Users\Admin\Pictures\OptimizePush.png => C:\Users\Admin\Pictures\OptimizePush.png.YmnQYw e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe File renamed C:\Users\Admin\Pictures\ProtectMove.tif => C:\Users\Admin\Pictures\ProtectMove.tif.LbyHNf e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe File renamed C:\Users\Admin\Pictures\SkipApprove.crw => C:\Users\Admin\Pictures\SkipApprove.crw.n1l5o5 e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe File renamed C:\Users\Admin\Pictures\UpdateProtect.crw => C:\Users\Admin\Pictures\UpdateProtect.crw.n1l5o5 e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe File renamed C:\Users\Admin\Pictures\WriteResolve.tif => C:\Users\Admin\Pictures\WriteResolve.tif.n1l5o5 e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe -
Drops startup file 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\43hy2xevz.dat e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.html e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\43hy2xevz.dat e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.html e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\123456789.bmp" e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4092 e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe 4092 e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe -
Suspicious use of AdjustPrivilegeToken 89 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3472 wmic.exe Token: SeSecurityPrivilege 3472 wmic.exe Token: SeTakeOwnershipPrivilege 3472 wmic.exe Token: SeLoadDriverPrivilege 3472 wmic.exe Token: SeSystemProfilePrivilege 3472 wmic.exe Token: SeSystemtimePrivilege 3472 wmic.exe Token: SeProfSingleProcessPrivilege 3472 wmic.exe Token: SeIncBasePriorityPrivilege 3472 wmic.exe Token: SeCreatePagefilePrivilege 3472 wmic.exe Token: SeBackupPrivilege 3472 wmic.exe Token: SeRestorePrivilege 3472 wmic.exe Token: SeShutdownPrivilege 3472 wmic.exe Token: SeDebugPrivilege 3472 wmic.exe Token: SeSystemEnvironmentPrivilege 3472 wmic.exe Token: SeRemoteShutdownPrivilege 3472 wmic.exe Token: SeUndockPrivilege 3472 wmic.exe Token: SeManageVolumePrivilege 3472 wmic.exe Token: 33 3472 wmic.exe Token: 34 3472 wmic.exe Token: 35 3472 wmic.exe Token: 36 3472 wmic.exe Token: SeIncreaseQuotaPrivilege 3472 wmic.exe Token: SeSecurityPrivilege 3472 wmic.exe Token: SeTakeOwnershipPrivilege 3472 wmic.exe Token: SeLoadDriverPrivilege 3472 wmic.exe Token: SeSystemProfilePrivilege 3472 wmic.exe Token: SeSystemtimePrivilege 3472 wmic.exe Token: SeProfSingleProcessPrivilege 3472 wmic.exe Token: SeIncBasePriorityPrivilege 3472 wmic.exe Token: SeCreatePagefilePrivilege 3472 wmic.exe Token: SeBackupPrivilege 3472 wmic.exe Token: SeRestorePrivilege 3472 wmic.exe Token: SeShutdownPrivilege 3472 wmic.exe Token: SeDebugPrivilege 3472 wmic.exe Token: SeSystemEnvironmentPrivilege 3472 wmic.exe Token: SeRemoteShutdownPrivilege 3472 wmic.exe Token: SeUndockPrivilege 3472 wmic.exe Token: SeManageVolumePrivilege 3472 wmic.exe Token: 33 3472 wmic.exe Token: 34 3472 wmic.exe Token: 35 3472 wmic.exe Token: 36 3472 wmic.exe Token: SeBackupPrivilege 1932 vssvc.exe Token: SeRestorePrivilege 1932 vssvc.exe Token: SeAuditPrivilege 1932 vssvc.exe Token: SeIncreaseQuotaPrivilege 2704 wmic.exe Token: SeSecurityPrivilege 2704 wmic.exe Token: SeTakeOwnershipPrivilege 2704 wmic.exe Token: SeLoadDriverPrivilege 2704 wmic.exe Token: SeSystemProfilePrivilege 2704 wmic.exe Token: SeSystemtimePrivilege 2704 wmic.exe Token: SeProfSingleProcessPrivilege 2704 wmic.exe Token: SeIncBasePriorityPrivilege 2704 wmic.exe Token: SeCreatePagefilePrivilege 2704 wmic.exe Token: SeBackupPrivilege 2704 wmic.exe Token: SeRestorePrivilege 2704 wmic.exe Token: SeShutdownPrivilege 2704 wmic.exe Token: SeDebugPrivilege 2704 wmic.exe Token: SeSystemEnvironmentPrivilege 2704 wmic.exe Token: SeRemoteShutdownPrivilege 2704 wmic.exe Token: SeUndockPrivilege 2704 wmic.exe Token: SeManageVolumePrivilege 2704 wmic.exe Token: 33 2704 wmic.exe Token: 34 2704 wmic.exe Token: 35 2704 wmic.exe Token: 36 2704 wmic.exe Token: SeIncreaseQuotaPrivilege 2704 wmic.exe Token: SeSecurityPrivilege 2704 wmic.exe Token: SeTakeOwnershipPrivilege 2704 wmic.exe Token: SeLoadDriverPrivilege 2704 wmic.exe Token: SeSystemProfilePrivilege 2704 wmic.exe Token: SeSystemtimePrivilege 2704 wmic.exe Token: SeProfSingleProcessPrivilege 2704 wmic.exe Token: SeIncBasePriorityPrivilege 2704 wmic.exe Token: SeCreatePagefilePrivilege 2704 wmic.exe Token: SeBackupPrivilege 2704 wmic.exe Token: SeRestorePrivilege 2704 wmic.exe Token: SeShutdownPrivilege 2704 wmic.exe Token: SeDebugPrivilege 2704 wmic.exe Token: SeSystemEnvironmentPrivilege 2704 wmic.exe Token: SeRemoteShutdownPrivilege 2704 wmic.exe Token: SeUndockPrivilege 2704 wmic.exe Token: SeManageVolumePrivilege 2704 wmic.exe Token: 33 2704 wmic.exe Token: 34 2704 wmic.exe Token: 35 2704 wmic.exe Token: 36 2704 wmic.exe Token: 33 2688 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2688 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2136 OpenWith.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4092 wrote to memory of 3472 4092 e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe 75 PID 4092 wrote to memory of 3472 4092 e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe 75 PID 4092 wrote to memory of 2704 4092 e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe 82 PID 4092 wrote to memory of 2704 4092 e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe"C:\Users\Admin\AppData\Local\Temp\e8a091a84dd2ea7ee429135ff48e9f48f7787637ccb79f6c3eb42f34588bc684.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\system32\wbem\wmic.exe"C:\w\..\Windows\lfwh\..\system32\b\..\wbem\f\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3472
-
-
C:\Windows\system32\wbem\wmic.exe"C:\m\..\Windows\dx\kgjyc\..\..\system32\govt\khre\brr\..\..\..\wbem\eisfb\gc\..\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2704
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1932
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4101⤵PID:2688
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2136