Analysis
- max time kernel
103s - max time network
105s - platform
windows10_x64 - resource
win10v20201028 - submitted
26/01/2021, 11:44
Static task
static1
Behavioral task
behavioral1
Sample
xs_normal - Copy.bin.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
xs_normal - Copy.bin.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target xs_normal - Copy.bin.exe
- Size 169KB
- Sample210126-ftk99dls8n
- SHA256 b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe
- MD5 98562209465bec53327e65649a2b8829
- SHA1 3a47656ed3df213bd934aa01078a863568fe9f2b
- SHA512 c11ce14f9cb75df2bc9bd81971c1f8fa885815715f389eb8e796e0f657de59756b36a6f896c216a03c7be7bb3ddff9b8a47aee71146760e4f4d9c6bdc0ff2cc3
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
- Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 4020 bcdedit.exe 2124 bcdedit.exe - Modifies Windows Firewall 1 TTPs
- Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\CloseDeny.tiff xs_normal - Copy.bin.exe File opened for modification C:\Users\Admin\Pictures\ConvertToPush.tiff xs_normal - Copy.bin.exe File renamed C:\Users\Admin\Pictures\RevokeDisconnect.tif => C:\Users\Admin\Pictures\RevokeDisconnect.tif.2123D.thor xs_normal - Copy.bin.exe File renamed C:\Users\Admin\Pictures\GetRepair.crw => C:\Users\Admin\Pictures\GetRepair.crw.2123D.thor xs_normal - Copy.bin.exe File renamed C:\Users\Admin\Pictures\SplitConfirm.png => C:\Users\Admin\Pictures\SplitConfirm.png.2123D.thor xs_normal - Copy.bin.exe File renamed C:\Users\Admin\Pictures\CloseDeny.tiff => C:\Users\Admin\Pictures\CloseDeny.tiff.2123D.thor xs_normal - Copy.bin.exe File renamed C:\Users\Admin\Pictures\ConvertToPush.tiff => C:\Users\Admin\Pictures\ConvertToPush.tiff.2123D.thor xs_normal - Copy.bin.exe File renamed C:\Users\Admin\Pictures\DenyWrite.crw => C:\Users\Admin\Pictures\DenyWrite.crw.2123D.thor xs_normal - Copy.bin.exe File renamed C:\Users\Admin\Pictures\GroupSubmit.crw => C:\Users\Admin\Pictures\GroupSubmit.crw.2123D.thor xs_normal - Copy.bin.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Configuration\configuration.sqlite xs_normal - Copy.bin.exe - Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 908 vssadmin.exe - Kills process with taskkill 13 IoCs
pid Process 4120 taskkill.exe 4244 taskkill.exe 4232 taskkill.exe 4144 taskkill.exe 4108 taskkill.exe 4288 taskkill.exe 4132 taskkill.exe 4156 taskkill.exe 4168 taskkill.exe 4212 taskkill.exe 4192 taskkill.exe 4300 taskkill.exe 4324 taskkill.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 4904 PING.EXE - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1056 xs_normal - Copy.bin.exe 1056 xs_normal - Copy.bin.exe - Suspicious use of AdjustPrivilegeToken 58 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2628 WMIC.exe Token: SeSecurityPrivilege 2628 WMIC.exe Token: SeTakeOwnershipPrivilege 2628 WMIC.exe Token: SeLoadDriverPrivilege 2628 WMIC.exe Token: SeSystemProfilePrivilege 2628 WMIC.exe Token: SeSystemtimePrivilege 2628 WMIC.exe Token: SeProfSingleProcessPrivilege 2628 WMIC.exe Token: SeIncBasePriorityPrivilege 2628 WMIC.exe Token: SeCreatePagefilePrivilege 2628 WMIC.exe Token: SeBackupPrivilege 2628 WMIC.exe Token: SeRestorePrivilege 2628 WMIC.exe Token: SeShutdownPrivilege 2628 WMIC.exe Token: SeDebugPrivilege 2628 WMIC.exe Token: SeSystemEnvironmentPrivilege 2628 WMIC.exe Token: SeRemoteShutdownPrivilege 2628 WMIC.exe Token: SeUndockPrivilege 2628 WMIC.exe Token: SeManageVolumePrivilege 2628 WMIC.exe Token: 33 2628 WMIC.exe Token: 34 2628 WMIC.exe Token: 35 2628 WMIC.exe Token: 36 2628 WMIC.exe Token: SeBackupPrivilege 2420 vssvc.exe Token: SeRestorePrivilege 2420 vssvc.exe Token: SeAuditPrivilege 2420 vssvc.exe Token: SeIncreaseQuotaPrivilege 2628 WMIC.exe Token: SeSecurityPrivilege 2628 WMIC.exe Token: SeTakeOwnershipPrivilege 2628 WMIC.exe Token: SeLoadDriverPrivilege 2628 WMIC.exe Token: SeSystemProfilePrivilege 2628 WMIC.exe Token: SeSystemtimePrivilege 2628 WMIC.exe Token: SeProfSingleProcessPrivilege 2628 WMIC.exe Token: SeIncBasePriorityPrivilege 2628 WMIC.exe Token: SeCreatePagefilePrivilege 2628 WMIC.exe Token: SeBackupPrivilege 2628 WMIC.exe Token: SeRestorePrivilege 2628 WMIC.exe Token: SeShutdownPrivilege 2628 WMIC.exe Token: SeDebugPrivilege 2628 WMIC.exe Token: SeSystemEnvironmentPrivilege 2628 WMIC.exe Token: SeRemoteShutdownPrivilege 2628 WMIC.exe Token: SeUndockPrivilege 2628 WMIC.exe Token: SeManageVolumePrivilege 2628 WMIC.exe Token: 33 2628 WMIC.exe Token: 34 2628 WMIC.exe Token: 35 2628 WMIC.exe Token: 36 2628 WMIC.exe Token: SeDebugPrivilege 4144 taskkill.exe Token: SeDebugPrivilege 4132 taskkill.exe Token: SeDebugPrivilege 4108 taskkill.exe Token: SeDebugPrivilege 4120 taskkill.exe Token: SeDebugPrivilege 4156 taskkill.exe Token: SeDebugPrivilege 4168 taskkill.exe Token: SeDebugPrivilege 4192 taskkill.exe Token: SeDebugPrivilege 4212 taskkill.exe Token: SeDebugPrivilege 4244 taskkill.exe Token: SeDebugPrivilege 4232 taskkill.exe Token: SeDebugPrivilege 4288 taskkill.exe Token: SeDebugPrivilege 4300 taskkill.exe Token: SeDebugPrivilege 4324 taskkill.exe - Suspicious use of WriteProcessMemory 104 IoCs
description pid Process procid_target PID 1056 wrote to memory of 2552 1056 xs_normal - Copy.bin.exe 72 PID 1056 wrote to memory of 2552 1056 xs_normal - Copy.bin.exe 72 PID 1056 wrote to memory of 2612 1056 xs_normal - Copy.bin.exe 73 PID 1056 wrote to memory of 2612 1056 xs_normal - Copy.bin.exe 73 PID 1056 wrote to memory of 2852 1056 xs_normal - Copy.bin.exe 74 PID 1056 wrote to memory of 2852 1056 xs_normal - Copy.bin.exe 74 PID 1056 wrote to memory of 2944 1056 xs_normal - Copy.bin.exe 81 PID 1056 wrote to memory of 2944 1056 xs_normal - Copy.bin.exe 81 PID 1056 wrote to memory of 3404 1056 xs_normal - Copy.bin.exe 80 PID 1056 wrote to memory of 3404 1056 xs_normal - Copy.bin.exe 80 PID 2944 wrote to memory of 4020 2944 cmd.exe 82 PID 2944 wrote to memory of 4020 2944 cmd.exe 82 PID 3404 wrote to memory of 2160 3404 cmd.exe 85 PID 3404 wrote to memory of 2160 3404 cmd.exe 85 PID 2852 wrote to memory of 2124 2852 cmd.exe 84 PID 2852 wrote to memory of 2124 2852 cmd.exe 84 PID 2612 wrote to memory of 2628 2612 cmd.exe 86 PID 2612 wrote to memory of 2628 2612 cmd.exe 86 PID 2552 wrote to memory of 908 2552 cmd.exe 87 PID 2552 wrote to memory of 908 2552 cmd.exe 87 PID 1056 wrote to memory of 3164 1056 xs_normal - Copy.bin.exe 95 PID 1056 wrote to memory of 3164 1056 xs_normal - Copy.bin.exe 95 PID 1056 wrote to memory of 3164 1056 xs_normal - Copy.bin.exe 95 PID 1056 wrote to memory of 2424 1056 xs_normal - Copy.bin.exe 120 PID 1056 wrote to memory of 2424 1056 xs_normal - Copy.bin.exe 120 PID 1056 wrote to memory of 2424 1056 xs_normal - Copy.bin.exe 120 PID 1056 wrote to memory of 1772 1056 xs_normal - Copy.bin.exe 119 PID 1056 wrote to memory of 1772 1056 xs_normal - Copy.bin.exe 119 PID 1056 wrote to memory of 1772 1056 xs_normal - Copy.bin.exe 119 PID 1056 wrote to memory of 212 1056 xs_normal - Copy.bin.exe 97 PID 1056 wrote to memory of 212 1056 xs_normal - Copy.bin.exe 97 PID 1056 wrote to memory of 212 1056 xs_normal - Copy.bin.exe 97 PID 1056 wrote to memory of 3860 1056 xs_normal - Copy.bin.exe 98 PID 1056 wrote to memory of 3860 1056 xs_normal - Copy.bin.exe 98 PID 1056 wrote to memory of 3860 1056 xs_normal - Copy.bin.exe 98 PID 1056 wrote to memory of 2088 1056 xs_normal - Copy.bin.exe 99 PID 1056 wrote to memory of 2088 1056 xs_normal - Copy.bin.exe 99 PID 1056 wrote to memory of 2088 1056 xs_normal - Copy.bin.exe 99 PID 1056 wrote to memory of 3240 1056 xs_normal - Copy.bin.exe 115 PID 1056 wrote to memory of 3240 1056 xs_normal - Copy.bin.exe 115 PID 1056 wrote to memory of 3240 1056 xs_normal - Copy.bin.exe 115 PID 1056 wrote to memory of 3996 1056 xs_normal - Copy.bin.exe 114 PID 1056 wrote to memory of 3996 1056 xs_normal - Copy.bin.exe 114 PID 1056 wrote to memory of 3996 1056 xs_normal - Copy.bin.exe 114 PID 1056 wrote to memory of 644 1056 xs_normal - Copy.bin.exe 103 PID 1056 wrote to memory of 644 1056 xs_normal - Copy.bin.exe 103 PID 1056 wrote to memory of 644 1056 xs_normal - Copy.bin.exe 103 PID 1056 wrote to memory of 2236 1056 xs_normal - Copy.bin.exe 104 PID 1056 wrote to memory of 2236 1056 xs_normal - Copy.bin.exe 104 PID 1056 wrote to memory of 2236 1056 xs_normal - Copy.bin.exe 104 PID 1056 wrote to memory of 256 1056 xs_normal - Copy.bin.exe 111 PID 1056 wrote to memory of 256 1056 xs_normal - Copy.bin.exe 111 PID 1056 wrote to memory of 256 1056 xs_normal - Copy.bin.exe 111 PID 1056 wrote to memory of 1584 1056 xs_normal - Copy.bin.exe 106 PID 1056 wrote to memory of 1584 1056 xs_normal - Copy.bin.exe 106 PID 1056 wrote to memory of 1584 1056 xs_normal - Copy.bin.exe 106 PID 1056 wrote to memory of 1600 1056 xs_normal - Copy.bin.exe 107 PID 1056 wrote to memory of 1600 1056 xs_normal - Copy.bin.exe 107 PID 1056 wrote to memory of 1600 1056 xs_normal - Copy.bin.exe 107 PID 2424 wrote to memory of 4108 2424 cmd.exe 131 PID 2424 wrote to memory of 4108 2424 cmd.exe 131 PID 2424 wrote to memory of 4108 2424 cmd.exe 131 PID 3164 wrote to memory of 4120 3164 cmd.exe 122 PID 3164 wrote to memory of 4120 3164 cmd.exe 122 PID 3164 wrote to memory of 4120 3164 cmd.exe 122 PID 1772 wrote to memory of 4132 1772 cmd.exe 123 PID 1772 wrote to memory of 4132 1772 cmd.exe 123 PID 1772 wrote to memory of 4132 1772 cmd.exe 123 PID 212 wrote to memory of 4144 212 cmd.exe 130 PID 212 wrote to memory of 4144 212 cmd.exe 130 PID 212 wrote to memory of 4144 212 cmd.exe 130 PID 3860 wrote to memory of 4156 3860 cmd.exe 124 PID 3860 wrote to memory of 4156 3860 cmd.exe 124 PID 3860 wrote to memory of 4156 3860 cmd.exe 124 PID 2088 wrote to memory of 4168 2088 cmd.exe 125 PID 2088 wrote to memory of 4168 2088 cmd.exe 125 PID 2088 wrote to memory of 4168 2088 cmd.exe 125 PID 3240 wrote to memory of 4192 3240 cmd.exe 127 PID 3240 wrote to memory of 4192 3240 cmd.exe 127 PID 3240 wrote to memory of 4192 3240 cmd.exe 127 PID 3996 wrote to memory of 4212 3996 cmd.exe 126 PID 3996 wrote to memory of 4212 3996 cmd.exe 126 PID 3996 wrote to memory of 4212 3996 cmd.exe 126 PID 644 wrote to memory of 4232 644 cmd.exe 129 PID 644 wrote to memory of 4232 644 cmd.exe 129 PID 644 wrote to memory of 4232 644 cmd.exe 129 PID 2236 wrote to memory of 4244 2236 cmd.exe 128 PID 2236 wrote to memory of 4244 2236 cmd.exe 128 PID 2236 wrote to memory of 4244 2236 cmd.exe 128 PID 256 wrote to memory of 4288 256 cmd.exe 134 PID 256 wrote to memory of 4288 256 cmd.exe 134 PID 256 wrote to memory of 4288 256 cmd.exe 134 PID 1584 wrote to memory of 4300 1584 cmd.exe 132 PID 1584 wrote to memory of 4300 1584 cmd.exe 132 PID 1584 wrote to memory of 4300 1584 cmd.exe 132 PID 1600 wrote to memory of 4324 1600 cmd.exe 133 PID 1600 wrote to memory of 4324 1600 cmd.exe 133 PID 1600 wrote to memory of 4324 1600 cmd.exe 133 PID 1056 wrote to memory of 4860 1056 xs_normal - Copy.bin.exe 136 PID 1056 wrote to memory of 4860 1056 xs_normal - Copy.bin.exe 136 PID 1056 wrote to memory of 4860 1056 xs_normal - Copy.bin.exe 136 PID 4860 wrote to memory of 4904 4860 cmd.exe 138 PID 4860 wrote to memory of 4904 4860 cmd.exe 138 PID 4860 wrote to memory of 4904 4860 cmd.exe 138
Processes
-
C:\Users\Admin\AppData\Local\Temp\xs_normal - Copy.bin.exe"C:\Users\Admin\AppData\Local\Temp\xs_normal - Copy.bin.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c vssadmin delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:908
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c wmic shadowcopy delete /nointeractive2⤵
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c bcdedit /set {current} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2124
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c netsh advfirewall set allprofiles state off2⤵
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off3⤵PID:2160
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c bcdedit /set {current} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:4020
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im note*2⤵
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im note*3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4120
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im excel*2⤵PID:212
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im excel*3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4144
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im Exchange*2⤵PID:3860
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Exchange*3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4156
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im sql*2⤵PID:2088
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sql*3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4168
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im java*2⤵PID:644
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im java*3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4232
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im python*2⤵PID:2236
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im python*3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4244
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im post*2⤵PID:1584
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im post*3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4300
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im mys*2⤵PID:1600
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im mys*3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4324
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im vee*2⤵PID:256
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im vee*3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4288
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im apache*2⤵PID:3996
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im apache*3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4212
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im tomcat*2⤵PID:3240
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im tomcat*3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4192
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im winword*2⤵PID:1772
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im winword*3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4132
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im powerpnt*2⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im powerpnt*3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4108
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1>nul & del /q C:\Users\Admin\AppData\Local\Temp\xs_normal - Copy.bin.exe2⤵PID:4860
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:4904
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2420