Analysis
-
max time kernel
58s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
01-01-2021 18:03
Static task
static1
Behavioral task
behavioral1
Sample
ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe
Resource
win10v20201028
General
-
Target
ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe
-
Size
1.8MB
-
MD5
7d4550dd4c6996057147ecc996b14e9a
-
SHA1
d0d68281f8459b5558559fbbf8c6c8ab4ddfec8b
-
SHA256
ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d
-
SHA512
e0653ac9c92bd134ff43886b4a8a36016660294c134ff11c6cddefe50494923fdcf370c3d96d5538d2c7ef20d216b4d15b914d40002c982c69021ee8998f57df
Malware Config
Extracted
C:\HOW-TO-DECRYPT-gn9cj.txt
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Algpid process 2968 Alg -
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
Algdescription ioc process File renamed C:\Users\Admin\Pictures\ConvertFromBlock.tiff => C:\Users\Admin\Pictures\ConvertFromBlock.tiff.gn9cj Alg File opened for modification C:\Users\Admin\Pictures\ConvertFromBlock.tiff.gn9cj Alg File renamed C:\Users\Admin\Pictures\FormatPing.tiff => C:\Users\Admin\Pictures\FormatPing.tiff.gn9cj Alg File renamed C:\Users\Admin\Pictures\MeasureMerge.crw => C:\Users\Admin\Pictures\MeasureMerge.crw.gn9cj Alg File opened for modification C:\Users\Admin\Pictures\MeasureMerge.crw.gn9cj Alg File opened for modification C:\Users\Admin\Pictures\RedoSwitch.tiff.gn9cj Alg File opened for modification C:\Users\Admin\Pictures\WaitUninstall.tif.gn9cj Alg File opened for modification C:\Users\Admin\Pictures\FormatPing.tiff.gn9cj Alg File renamed C:\Users\Admin\Pictures\RedoSwitch.tiff => C:\Users\Admin\Pictures\RedoSwitch.tiff.gn9cj Alg File renamed C:\Users\Admin\Pictures\WaitUninstall.tif => C:\Users\Admin\Pictures\WaitUninstall.tif.gn9cj Alg -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exeAlgcmd.execmd.exedescription pid process target process PID 616 wrote to memory of 2968 616 ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe Alg PID 616 wrote to memory of 2968 616 ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe Alg PID 2968 wrote to memory of 1040 2968 Alg cmd.exe PID 2968 wrote to memory of 1040 2968 Alg cmd.exe PID 616 wrote to memory of 1328 616 ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe cmd.exe PID 616 wrote to memory of 1328 616 ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe cmd.exe PID 1040 wrote to memory of 3616 1040 cmd.exe waitfor.exe PID 1040 wrote to memory of 3616 1040 cmd.exe waitfor.exe PID 1328 wrote to memory of 3504 1328 cmd.exe waitfor.exe PID 1328 wrote to memory of 3504 1328 cmd.exe waitfor.exe PID 1328 wrote to memory of 2136 1328 cmd.exe attrib.exe PID 1328 wrote to memory of 2136 1328 cmd.exe attrib.exe PID 1040 wrote to memory of 3440 1040 cmd.exe attrib.exe PID 1040 wrote to memory of 3440 1040 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2136 attrib.exe 3440 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe"C:\Users\Admin\AppData\Local\Temp\ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SetupOem\AlgC:\Users\Admin\AppData\Roaming\SetupOem\Alg /go2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c waitfor /t 10 pause /d y & attrib -h "C:\Users\Admin\AppData\Roaming\SetupOem\Alg" & del "C:\Users\Admin\AppData\Roaming\SetupOem\Alg" & rd "C:\Users\Admin\AppData\Roaming\SetupOem\"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\waitfor.exewaitfor /t 10 pause /d y4⤵
-
C:\Windows\system32\attrib.exeattrib -h "C:\Users\Admin\AppData\Roaming\SetupOem\Alg"4⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\cmd.execmd /c waitfor /t 10 pause /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe" & del "C:\Users\Admin\AppData\Local\Temp\ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe" & rd "C:\Users\Admin\AppData\Local\Temp\"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\waitfor.exewaitfor /t 10 pause /d y3⤵
-
C:\Windows\system32\attrib.exeattrib -h "C:\Users\Admin\AppData\Local\Temp\ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe"3⤵
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\SetupOem\AlgMD5
7d4550dd4c6996057147ecc996b14e9a
SHA1d0d68281f8459b5558559fbbf8c6c8ab4ddfec8b
SHA256ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d
SHA512e0653ac9c92bd134ff43886b4a8a36016660294c134ff11c6cddefe50494923fdcf370c3d96d5538d2c7ef20d216b4d15b914d40002c982c69021ee8998f57df
-
C:\Users\Admin\AppData\Roaming\SetupOem\AlgMD5
7d4550dd4c6996057147ecc996b14e9a
SHA1d0d68281f8459b5558559fbbf8c6c8ab4ddfec8b
SHA256ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d
SHA512e0653ac9c92bd134ff43886b4a8a36016660294c134ff11c6cddefe50494923fdcf370c3d96d5538d2c7ef20d216b4d15b914d40002c982c69021ee8998f57df
-
memory/1040-5-0x0000000000000000-mapping.dmp
-
memory/1328-6-0x0000000000000000-mapping.dmp
-
memory/2136-9-0x0000000000000000-mapping.dmp
-
memory/2968-2-0x0000000000000000-mapping.dmp
-
memory/3440-10-0x0000000000000000-mapping.dmp
-
memory/3504-8-0x0000000000000000-mapping.dmp
-
memory/3616-7-0x0000000000000000-mapping.dmp