Analysis
-
max time kernel
10s -
max time network
8s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
01-01-2021 18:03
Static task
static1
Behavioral task
behavioral1
Sample
ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe
Resource
win10v20201028
General
-
Target
ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe
-
Size
1.8MB
-
MD5
7d4550dd4c6996057147ecc996b14e9a
-
SHA1
d0d68281f8459b5558559fbbf8c6c8ab4ddfec8b
-
SHA256
ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d
-
SHA512
e0653ac9c92bd134ff43886b4a8a36016660294c134ff11c6cddefe50494923fdcf370c3d96d5538d2c7ef20d216b4d15b914d40002c982c69021ee8998f57df
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\HOW-TO-DECRYPT-gn9cj.txt
Extracted
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\HOW-TO-DECRYPT-gn9cj.txt
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Tippid process 1712 Tip -
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
Tipdescription ioc process File opened for modification C:\Users\Admin\Pictures\DismountPublish.tif.gn9cj Tip File renamed C:\Users\Admin\Pictures\MeasureGroup.raw => C:\Users\Admin\Pictures\MeasureGroup.raw.gn9cj Tip File opened for modification C:\Users\Admin\Pictures\MeasureGroup.raw.gn9cj Tip File renamed C:\Users\Admin\Pictures\RestartProtect.tiff => C:\Users\Admin\Pictures\RestartProtect.tiff.gn9cj Tip File renamed C:\Users\Admin\Pictures\SuspendUnblock.png => C:\Users\Admin\Pictures\SuspendUnblock.png.gn9cj Tip File opened for modification C:\Users\Admin\Pictures\SuspendUnblock.png.gn9cj Tip File renamed C:\Users\Admin\Pictures\DismountPublish.tif => C:\Users\Admin\Pictures\DismountPublish.tif.gn9cj Tip File opened for modification C:\Users\Admin\Pictures\RestartProtect.tiff.gn9cj Tip File renamed C:\Users\Admin\Pictures\SyncWait.crw => C:\Users\Admin\Pictures\SyncWait.crw.gn9cj Tip File opened for modification C:\Users\Admin\Pictures\SyncWait.crw.gn9cj Tip File renamed C:\Users\Admin\Pictures\UndoPush.png => C:\Users\Admin\Pictures\UndoPush.png.gn9cj Tip File opened for modification C:\Users\Admin\Pictures\UndoPush.png.gn9cj Tip -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1584 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exepid process 1640 ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe 1640 ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exeTipcmd.execmd.exedescription pid process target process PID 1640 wrote to memory of 1712 1640 ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe Tip PID 1640 wrote to memory of 1712 1640 ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe Tip PID 1640 wrote to memory of 1712 1640 ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe Tip PID 1712 wrote to memory of 1616 1712 Tip cmd.exe PID 1712 wrote to memory of 1616 1712 Tip cmd.exe PID 1712 wrote to memory of 1616 1712 Tip cmd.exe PID 1640 wrote to memory of 1584 1640 ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe cmd.exe PID 1640 wrote to memory of 1584 1640 ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe cmd.exe PID 1640 wrote to memory of 1584 1640 ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe cmd.exe PID 1616 wrote to memory of 1100 1616 cmd.exe waitfor.exe PID 1616 wrote to memory of 1100 1616 cmd.exe waitfor.exe PID 1616 wrote to memory of 1100 1616 cmd.exe waitfor.exe PID 1584 wrote to memory of 1088 1584 cmd.exe waitfor.exe PID 1584 wrote to memory of 1088 1584 cmd.exe waitfor.exe PID 1584 wrote to memory of 1088 1584 cmd.exe waitfor.exe PID 1616 wrote to memory of 268 1616 cmd.exe attrib.exe PID 1616 wrote to memory of 268 1616 cmd.exe attrib.exe PID 1616 wrote to memory of 268 1616 cmd.exe attrib.exe PID 1584 wrote to memory of 272 1584 cmd.exe attrib.exe PID 1584 wrote to memory of 272 1584 cmd.exe attrib.exe PID 1584 wrote to memory of 272 1584 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 268 attrib.exe 272 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe"C:\Users\Admin\AppData\Local\Temp\ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\CenterLibrary\TipC:\Users\Admin\AppData\Roaming\CenterLibrary\Tip /go2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c waitfor /t 10 pause /d y & attrib -h "C:\Users\Admin\AppData\Roaming\CenterLibrary\Tip" & del "C:\Users\Admin\AppData\Roaming\CenterLibrary\Tip" & rd "C:\Users\Admin\AppData\Roaming\CenterLibrary\"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\waitfor.exewaitfor /t 10 pause /d y4⤵
-
C:\Windows\system32\attrib.exeattrib -h "C:\Users\Admin\AppData\Roaming\CenterLibrary\Tip"4⤵
- Views/modifies file attributes
-
C:\Windows\system32\cmd.execmd /c waitfor /t 10 pause /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe" & del "C:\Users\Admin\AppData\Local\Temp\ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe" & rd "C:\Users\Admin\AppData\Local\Temp\"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\waitfor.exewaitfor /t 10 pause /d y3⤵
-
C:\Windows\system32\attrib.exeattrib -h "C:\Users\Admin\AppData\Local\Temp\ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe"3⤵
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\CenterLibrary\TipMD5
7d4550dd4c6996057147ecc996b14e9a
SHA1d0d68281f8459b5558559fbbf8c6c8ab4ddfec8b
SHA256ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d
SHA512e0653ac9c92bd134ff43886b4a8a36016660294c134ff11c6cddefe50494923fdcf370c3d96d5538d2c7ef20d216b4d15b914d40002c982c69021ee8998f57df
-
C:\Users\Admin\AppData\Roaming\CenterLibrary\TipMD5
7d4550dd4c6996057147ecc996b14e9a
SHA1d0d68281f8459b5558559fbbf8c6c8ab4ddfec8b
SHA256ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d
SHA512e0653ac9c92bd134ff43886b4a8a36016660294c134ff11c6cddefe50494923fdcf370c3d96d5538d2c7ef20d216b4d15b914d40002c982c69021ee8998f57df
-
\Users\Admin\AppData\Roaming\CenterLibrary\TipMD5
7d4550dd4c6996057147ecc996b14e9a
SHA1d0d68281f8459b5558559fbbf8c6c8ab4ddfec8b
SHA256ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d
SHA512e0653ac9c92bd134ff43886b4a8a36016660294c134ff11c6cddefe50494923fdcf370c3d96d5538d2c7ef20d216b4d15b914d40002c982c69021ee8998f57df
-
\Users\Admin\AppData\Roaming\CenterLibrary\TipMD5
7d4550dd4c6996057147ecc996b14e9a
SHA1d0d68281f8459b5558559fbbf8c6c8ab4ddfec8b
SHA256ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d
SHA512e0653ac9c92bd134ff43886b4a8a36016660294c134ff11c6cddefe50494923fdcf370c3d96d5538d2c7ef20d216b4d15b914d40002c982c69021ee8998f57df
-
memory/268-10-0x0000000000000000-mapping.dmp
-
memory/272-11-0x0000000000000000-mapping.dmp
-
memory/1088-9-0x0000000000000000-mapping.dmp
-
memory/1100-8-0x0000000000000000-mapping.dmp
-
memory/1584-7-0x0000000000000000-mapping.dmp
-
memory/1616-6-0x0000000000000000-mapping.dmp
-
memory/1712-4-0x0000000000000000-mapping.dmp