Overview

overview

10

Static

static

speedo.bin.exe

windows7_x64

10

speedo.bin.exe

windows10_x64

10

Analysis

  • max time kernel
    145s
  • max time network
    105s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    09-02-2021 18:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    speedo.bin.exe

  • Size

    50KB

  • MD5

    e0870a190c5eaefdae56f9c8773e36cd

  • SHA1

    a0d2ea755f3914354b76ed895e0024fe753808bc

  • SHA256

    1b1172500c6e1e1607b0b0bce4ec74f8b65ffafcd492d8cd2886a7b7f20efaa4

  • SHA512

    c68948866b06f2336b4be9ea6ec63daa3573d9a5a8185977e772bfd297a0b7cbf050fd5cc72cb782f53a4ba1bb7d46b683b7a3fcd69e047d0e30899e021efadd

Score
10/10
ransomwarespyware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\info.hta

Ransom Note
🔒 ALL YOUR DATA TURNED TO USELESS BINARY CODE 🔒 Your computer is infected with a virus. Send an email parasite@cock.li , specify in the subject your unique identifier 13W95 and you will definitly be helped to recover. NOTE: You can send 2 files as proof that we can return all your data. If the provided email doesn't work, please contact us at para5ite@tutanota.com Algorithms used are AES and RSA. IMPORTANT: 1. The infection was due to vulnerabilities in your software. 2. If you want to make sure that it is impossible to recover files using third-party software, do this not on all files, otherwise you may lose all data. 3. Only communication through our email can guarantee file recover for you. We are not responsible for the actions of third parties who promise to help you - most often they are scammers. 4. Please, do not try to rename encrypted files. 5. Our goal is to return your data, but if you don't contact us, we will not succeed.
Emails

parasite@cock.li

para5ite@tutanota.com

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Interacts with shadow copies 2 TTPs 3 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 60 IoCs
    adwarespyware
  • Modifies registry class 2 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\speedo.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\speedo.bin.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1740
    • \??\c:\windows\system32\cmstp.exe
      "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\g42dqzwq.inf
      2⤵
        PID:1876
    • C:\Windows\system32\cmd.exe
      cmd /c start C:\Windows\temp\qmmxwrna.exe
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1552
      • C:\Windows\temp\qmmxwrna.exe
        C:\Windows\temp\qmmxwrna.exe
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: CmdExeWriteProcessMemorySpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1800
        • C:\Users\Admin\AppData\Roaming\98561.exe
          "C:\Users\Admin\AppData\Roaming\98561.exe"
          3⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1900
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1960
            • C:\Windows\SysWOW64\vssadmin.exe
              vssadmin.exe delete shadows /all /quiet
              5⤵
              • Interacts with shadow copies
              PID:1152
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1556
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic shadowcopy delete
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:904
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
            4⤵
              PID:1212
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1668
              • C:\Windows\SysWOW64\vssadmin.exe
                vssadmin.exe delete shadows /all /quiet
                5⤵
                • Interacts with shadow copies
                PID:1640
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1660
              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                wmic shadowcopy delete
                5⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1380
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
              4⤵
                PID:396
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet
                4⤵
                  PID:1152
                  • C:\Windows\SysWOW64\vssadmin.exe
                    vssadmin.exe delete shadows /all /quiet
                    5⤵
                    • Interacts with shadow copies
                    PID:1584
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
                  4⤵
                    PID:1800
                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                      wmic shadowcopy delete
                      5⤵
                        PID:272
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
                      4⤵
                        PID:316
                      • C:\Windows\SysWOW64\mshta.exe
                        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"
                        4⤵
                        • Modifies Internet Explorer settings
                        PID:1536
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 1 & Del "C:\Users\Admin\AppData\Roaming\98561.exe"
                        4⤵
                          PID:1636
                          • C:\Windows\SysWOW64\choice.exe
                            choice /C Y /N /D Y /T 1
                            5⤵
                              PID:1300
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 1 & Del "C:\Windows\temp\qmmxwrna.exe"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1648
                          • C:\Windows\SysWOW64\choice.exe
                            choice /C Y /N /D Y /T 1
                            4⤵
                              PID:1612
                      • C:\Windows\system32\taskkill.exe
                        taskkill /IM cmstp.exe /F
                        1⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1724
                      • C:\Windows\system32\vssvc.exe
                        C:\Windows\system32\vssvc.exe
                        1⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1552
                      • C:\Windows\SysWOW64\mshta.exe
                        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Documents\info.hta"
                        1⤵
                        • Modifies Internet Explorer settings
                        PID:328
                      • C:\Windows\system32\rundll32.exe
                        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Documents\info.hta
                        1⤵
                        • Modifies registry class
                        • Suspicious behavior: GetForegroundWindowSpam
                        PID:1348
                        • C:\Program Files\Internet Explorer\iexplore.exe
                          "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Documents\info.hta
                          2⤵
                          • Modifies Internet Explorer settings
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SetWindowsHookEx
                          PID:1876
                          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1876 CREDAT:275457 /prefetch:2
                            3⤵
                            • Modifies Internet Explorer settings
                            • Suspicious use of SetWindowsHookEx
                            PID:768
                      • C:\Windows\SysWOW64\mshta.exe
                        C:\Windows\SysWOW64\mshta.exe -Embedding
                        1⤵
                        • Modifies Internet Explorer settings
                        PID:1856
                      • C:\Program Files\Internet Explorer\iexplore.exe
                        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\info.hta
                        1⤵
                        • Modifies Internet Explorer settings
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SetWindowsHookEx
                        PID:2120
                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2120 CREDAT:275457 /prefetch:2
                          2⤵
                          • Modifies Internet Explorer settings
                          • Suspicious use of SetWindowsHookEx
                          PID:2176
                      • C:\Windows\SysWOW64\mshta.exe
                        C:\Windows\SysWOW64\mshta.exe -Embedding
                        1⤵
                        • Modifies Internet Explorer settings
                        PID:2244

                      Network

                      MITRE ATT&CK Matrix ATT&CK v6

                      Initial Access

                      Execution

                      Persistence

                      Privilege Escalation

                      Defense Evasion

                      File Deletion

                      2
                      T1107

                      Modify Registry

                      1
                      T1112

                      Credential Access

                      Credentials in Files

                      1
                      T1081

                      Discovery

                      System Information Discovery

                      1
                      T1082

                      Lateral Movement

                      Collection

                      Data from Local System

                      1
                      T1005

                      Exfiltration

                      Command and Control

                      Impact

                      Inhibit System Recovery

                      2
                      T1490

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Roaming\98561.exe
                        MD5

                        7bd1af2bf9a6444ed8f835886b203495

                        SHA1

                        a18ede85e2129bea96144a7165a8d49bfc29c3ed

                        SHA256

                        fa741ee3922bcadce51c42f2ce03bda09cfc96cb7f079a2794f69c98d985ec36

                        SHA512

                        c5a0c720ff6f90231bb4c376e7e4d2f33517566ddfa84f9dbe31cbac9d63b239babd1002e7fc00440c2182319c26a82f958b88fb59b087f4e2debef7fd9fbfe0

                        Download Submit
                      • C:\Users\Admin\AppData\Roaming\98561.exe
                        MD5

                        7bd1af2bf9a6444ed8f835886b203495

                        SHA1

                        a18ede85e2129bea96144a7165a8d49bfc29c3ed

                        SHA256

                        fa741ee3922bcadce51c42f2ce03bda09cfc96cb7f079a2794f69c98d985ec36

                        SHA512

                        c5a0c720ff6f90231bb4c376e7e4d2f33517566ddfa84f9dbe31cbac9d63b239babd1002e7fc00440c2182319c26a82f958b88fb59b087f4e2debef7fd9fbfe0

                        Download Submit
                      • C:\Users\Admin\Desktop\info.hta
                        MD5

                        487dc592df1c0a0f152147491cdc7b48

                        SHA1

                        4bba5387917cb3d764442ac2bcd05cd5ac1b104d

                        SHA256

                        9c63c7c53c7eb49e245451e2da4c586fc2e38d7bcc34324015d3588c245c374b

                        SHA512

                        96944585e24e77edf36f43717a66f2a68ee89474d630df4245bcb34d8c2a703d9c72498e441a2539af675605061b9585c1a902c4a8f4fd394c965b59c8473583

                        Download Submit
                      • C:\Users\Admin\Documents\info.hta
                        MD5

                        487dc592df1c0a0f152147491cdc7b48

                        SHA1

                        4bba5387917cb3d764442ac2bcd05cd5ac1b104d

                        SHA256

                        9c63c7c53c7eb49e245451e2da4c586fc2e38d7bcc34324015d3588c245c374b

                        SHA512

                        96944585e24e77edf36f43717a66f2a68ee89474d630df4245bcb34d8c2a703d9c72498e441a2539af675605061b9585c1a902c4a8f4fd394c965b59c8473583

                        Download Submit
                      • C:\Windows\Temp\qmmxwrna.exe
                        MD5

                        6612016ed61a65144813f238efe491a1

                        SHA1

                        3a77f98b94a92f482c194ef4d57df1ad05d446ad

                        SHA256

                        affdb2f84b3ae8459618a81731f364775386cd8b39b6ec795c5ae80287fed7cc

                        SHA512

                        8bffd0759b021b534ba1f7cec57ad7f714c0f189d77b20e363e7de6d77e6c3867dfd0ca1e6c6d8e245252332b5ffff5c49b7ebbc8beb8d5d6c071dafcccada5d

                        Download Submit
                      • C:\Windows\temp\g42dqzwq.inf
                        MD5

                        e90fddc40f00adbffb6c46b8f55f6bbd

                        SHA1

                        635adc423df540015edee5b43057edb6673cd4e0

                        SHA256

                        756e9b82214619b4017d987cc4e74b2e0cd87466b851c357273d537bbb3ea066

                        SHA512

                        c828a5c8f9b48098dacb3db4417a9a0107d72b4f2dddfb2fccc035af1d637a2ee532db9a39a5fe5273fb0bd3033d9dbb2044d3803270a9cd0fd751e6acbb2062

                        Download Submit
                      • C:\Windows\temp\qmmxwrna.exe
                        MD5

                        6612016ed61a65144813f238efe491a1

                        SHA1

                        3a77f98b94a92f482c194ef4d57df1ad05d446ad

                        SHA256

                        affdb2f84b3ae8459618a81731f364775386cd8b39b6ec795c5ae80287fed7cc

                        SHA512

                        8bffd0759b021b534ba1f7cec57ad7f714c0f189d77b20e363e7de6d77e6c3867dfd0ca1e6c6d8e245252332b5ffff5c49b7ebbc8beb8d5d6c071dafcccada5d

                        Download Submit
                      • \??\PIPE\srvsvc
                        MD5

                        d41d8cd98f00b204e9800998ecf8427e

                        SHA1

                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                        SHA256

                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                        SHA512

                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                        Download Submit
                      • \Users\Admin\AppData\Roaming\98561.exe
                        MD5

                        7bd1af2bf9a6444ed8f835886b203495

                        SHA1

                        a18ede85e2129bea96144a7165a8d49bfc29c3ed

                        SHA256

                        fa741ee3922bcadce51c42f2ce03bda09cfc96cb7f079a2794f69c98d985ec36

                        SHA512

                        c5a0c720ff6f90231bb4c376e7e4d2f33517566ddfa84f9dbe31cbac9d63b239babd1002e7fc00440c2182319c26a82f958b88fb59b087f4e2debef7fd9fbfe0

                        Download Submit
                      • memory/272-48-0x0000000000000000-mapping.dmp
                        Download
                      • memory/316-46-0x0000000000000000-mapping.dmp
                        Download
                      • memory/396-41-0x0000000000000000-mapping.dmp
                        Download
                      • memory/768-58-0x0000000000000000-mapping.dmp
                        Download
                      • memory/904-38-0x0000000000000000-mapping.dmp
                        Download
                      • memory/1152-37-0x0000000000000000-mapping.dmp
                        Download
                      • memory/1152-44-0x0000000000000000-mapping.dmp
                        Download
                      • memory/1212-36-0x0000000000000000-mapping.dmp
                        Download
                      • memory/1300-51-0x0000000000000000-mapping.dmp
                        Download
                      • memory/1380-43-0x0000000000000000-mapping.dmp
                        Download
                      • memory/1536-49-0x0000000000000000-mapping.dmp
                        Download
                      • memory/1556-35-0x0000000000000000-mapping.dmp
                        Download
                      • memory/1584-47-0x0000000000000000-mapping.dmp
                        Download
                      • memory/1612-32-0x0000000000000000-mapping.dmp
                        Download
                      • memory/1636-50-0x0000000000000000-mapping.dmp
                        Download
                      • memory/1640-53-0x000007FEF63D0000-0x000007FEF664A000-memory.dmp
                        Filesize

                        2.5MB

                        Download
                      • memory/1640-42-0x0000000000000000-mapping.dmp
                        Download
                      • memory/1648-29-0x0000000000000000-mapping.dmp
                        Download
                      • memory/1660-40-0x0000000000000000-mapping.dmp
                        Download
                      • memory/1668-39-0x0000000000000000-mapping.dmp
                        Download
                      • memory/1740-8-0x000000001AEC0000-0x000000001AEC2000-memory.dmp
                        Filesize

                        8KB

                        Download
                      • memory/1740-9-0x000000001AEC6000-0x000000001AEE5000-memory.dmp
                        Filesize

                        124KB

                        Download
                      • memory/1740-3-0x0000000000BD0000-0x0000000000BD1000-memory.dmp
                        Filesize

                        4KB

                        Download
                      • memory/1740-15-0x000000001AEE9000-0x000000001AEEA000-memory.dmp
                        Filesize

                        4KB

                        Download
                      • memory/1740-10-0x000000001AEE5000-0x000000001AEE6000-memory.dmp
                        Filesize

                        4KB

                        Download
                      • memory/1740-2-0x000007FEF59E0000-0x000007FEF63CC000-memory.dmp
                        Filesize

                        9.9MB

                        Download
                      • memory/1740-11-0x000000001AEE6000-0x000000001AEE7000-memory.dmp
                        Filesize

                        4KB

                        Download
                      • memory/1740-14-0x000000001AEE8000-0x000000001AEE9000-memory.dmp
                        Filesize

                        4KB

                        Download
                      • memory/1740-13-0x000000001AEE7000-0x000000001AEE8000-memory.dmp
                        Filesize

                        4KB

                        Download
                      • memory/1740-12-0x000000001AEEA000-0x000000001AEEB000-memory.dmp
                        Filesize

                        4KB

                        Download
                      • memory/1800-18-0x0000000000000000-mapping.dmp
                        Download
                      • memory/1800-23-0x00000000766F1000-0x00000000766F3000-memory.dmp
                        Filesize

                        8KB

                        Download
                      • memory/1800-20-0x00000000741A0000-0x000000007488E000-memory.dmp
                        Filesize

                        6.9MB

                        Download
                      • memory/1800-45-0x0000000000000000-mapping.dmp
                        Download
                      • memory/1800-21-0x00000000003E0000-0x00000000003E1000-memory.dmp
                        Filesize

                        4KB

                        Download
                      • memory/1876-57-0x0000000000000000-mapping.dmp
                        Download
                      • memory/1876-7-0x000007FEFBDE1000-0x000007FEFBDE3000-memory.dmp
                        Filesize

                        8KB

                        Download
                      • memory/1876-60-0x00000000048E0000-0x00000000048E1000-memory.dmp
                        Filesize

                        4KB

                        Download
                      • memory/1876-5-0x0000000000000000-mapping.dmp
                        Download
                      • memory/1900-25-0x0000000000000000-mapping.dmp
                        Download
                      • memory/1900-30-0x0000000000150000-0x0000000000151000-memory.dmp
                        Filesize

                        4KB

                        Download
                      • memory/1900-33-0x0000000004C30000-0x0000000004C31000-memory.dmp
                        Filesize

                        4KB

                        Download
                      • memory/1900-28-0x00000000741A0000-0x000000007488E000-memory.dmp
                        Filesize

                        6.9MB

                        Download
                      • memory/1960-34-0x0000000000000000-mapping.dmp
                        Download
                      • memory/2120-63-0x00000000040F0000-0x00000000040F1000-memory.dmp
                        Filesize

                        4KB

                        Download
                      • memory/2176-61-0x0000000000000000-mapping.dmp
                        Download
                      • memory/2244-64-0x0000000000BE0000-0x0000000000BE2000-memory.dmp
                        Filesize

                        8KB

                        Download