Overview

overview

10

Static

static

speedo.bin.exe

windows7_x64

10

speedo.bin.exe

windows10_x64

10

Analysis

  • max time kernel
    145s
  • max time network
    105s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    09/02/2021, 18:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    speedo.bin.exe

  • Size

    50KB

  • MD5

    e0870a190c5eaefdae56f9c8773e36cd

  • SHA1

    a0d2ea755f3914354b76ed895e0024fe753808bc

  • SHA256

    1b1172500c6e1e1607b0b0bce4ec74f8b65ffafcd492d8cd2886a7b7f20efaa4

  • SHA512

    c68948866b06f2336b4be9ea6ec63daa3573d9a5a8185977e772bfd297a0b7cbf050fd5cc72cb782f53a4ba1bb7d46b683b7a3fcd69e047d0e30899e021efadd

Score
10/10
ransomwarespyware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\info.hta

Ransom Note
🔒 ALL YOUR DATA TURNED TO USELESS BINARY CODE 🔒 Your computer is infected with a virus. Send an email [email protected] , specify in the subject your unique identifier 13W95 and you will definitly be helped to recover. NOTE: You can send 2 files as proof that we can return all your data. If the provided email doesn't work, please contact us at [email protected] Algorithms used are AES and RSA. IMPORTANT: 1. The infection was due to vulnerabilities in your software. 2. If you want to make sure that it is impossible to recover files using third-party software, do this not on all files, otherwise you may lose all data. 3. Only communication through our email can guarantee file recover for you. We are not responsible for the actions of third parties who promise to help you - most often they are scammers. 4. Please, do not try to rename encrypted files. 5. Our goal is to return your data, but if you don't contact us, we will not succeed.

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Interacts with shadow copies 2 TTPs 3 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 60 IoCs
    adwarespyware
  • Modifies registry class 2 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\speedo.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\speedo.bin.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1740
    • \??\c:\windows\system32\cmstp.exe
      "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\g42dqzwq.inf
      2⤵
        PID:1876
    • C:\Windows\system32\cmd.exe
      cmd /c start C:\Windows\temp\qmmxwrna.exe
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1552
      • C:\Windows\temp\qmmxwrna.exe
        C:\Windows\temp\qmmxwrna.exe
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: CmdExeWriteProcessMemorySpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1800
        • C:\Users\Admin\AppData\Roaming\98561.exe
          "C:\Users\Admin\AppData\Roaming\98561.exe"
          3⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1900
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1960
            • C:\Windows\SysWOW64\vssadmin.exe
              vssadmin.exe delete shadows /all /quiet
              5⤵
              • Interacts with shadow copies
              PID:1152
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1556
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic shadowcopy delete
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:904
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
            4⤵
              PID:1212
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1668
              • C:\Windows\SysWOW64\vssadmin.exe
                vssadmin.exe delete shadows /all /quiet
                5⤵
                • Interacts with shadow copies
                PID:1640
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1660
              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                wmic shadowcopy delete
                5⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1380
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
              4⤵
                PID:396
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet
                4⤵
                  PID:1152
                  • C:\Windows\SysWOW64\vssadmin.exe
                    vssadmin.exe delete shadows /all /quiet
                    5⤵
                    • Interacts with shadow copies
                    PID:1584
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
                  4⤵
                    PID:1800
                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                      wmic shadowcopy delete
                      5⤵
                        PID:272
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
                      4⤵
                        PID:316
                      • C:\Windows\SysWOW64\mshta.exe
                        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"
                        4⤵
                        • Modifies Internet Explorer settings
                        PID:1536
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 1 & Del "C:\Users\Admin\AppData\Roaming\98561.exe"
                        4⤵
                          PID:1636
                          • C:\Windows\SysWOW64\choice.exe
                            choice /C Y /N /D Y /T 1
                            5⤵
                              PID:1300
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 1 & Del "C:\Windows\temp\qmmxwrna.exe"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1648
                          • C:\Windows\SysWOW64\choice.exe
                            choice /C Y /N /D Y /T 1
                            4⤵
                              PID:1612
                      • C:\Windows\system32\taskkill.exe
                        taskkill /IM cmstp.exe /F
                        1⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1724
                      • C:\Windows\system32\vssvc.exe
                        C:\Windows\system32\vssvc.exe
                        1⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1552
                      • C:\Windows\SysWOW64\mshta.exe
                        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Documents\info.hta"
                        1⤵
                        • Modifies Internet Explorer settings
                        PID:328
                      • C:\Windows\system32\rundll32.exe
                        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Documents\info.hta
                        1⤵
                        • Modifies registry class
                        • Suspicious behavior: GetForegroundWindowSpam
                        PID:1348
                        • C:\Program Files\Internet Explorer\iexplore.exe
                          "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Documents\info.hta
                          2⤵
                          • Modifies Internet Explorer settings
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SetWindowsHookEx
                          PID:1876
                          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1876 CREDAT:275457 /prefetch:2
                            3⤵
                            • Modifies Internet Explorer settings
                            • Suspicious use of SetWindowsHookEx
                            PID:768
                      • C:\Windows\SysWOW64\mshta.exe
                        C:\Windows\SysWOW64\mshta.exe -Embedding
                        1⤵
                        • Modifies Internet Explorer settings
                        PID:1856
                      • C:\Program Files\Internet Explorer\iexplore.exe
                        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\info.hta
                        1⤵
                        • Modifies Internet Explorer settings
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SetWindowsHookEx
                        PID:2120
                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2120 CREDAT:275457 /prefetch:2
                          2⤵
                          • Modifies Internet Explorer settings
                          • Suspicious use of SetWindowsHookEx
                          PID:2176
                      • C:\Windows\SysWOW64\mshta.exe
                        C:\Windows\SysWOW64\mshta.exe -Embedding
                        1⤵
                        • Modifies Internet Explorer settings
                        PID:2244

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • memory/1640-53-0x000007FEF63D0000-0x000007FEF664A000-memory.dmp

                        Filesize

                        2.5MB

                        Download

                      • memory/1740-8-0x000000001AEC0000-0x000000001AEC2000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/1740-9-0x000000001AEC6000-0x000000001AEE5000-memory.dmp

                        Filesize

                        124KB

                        Download

                      • memory/1740-3-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1740-15-0x000000001AEE9000-0x000000001AEEA000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1740-10-0x000000001AEE5000-0x000000001AEE6000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1740-2-0x000007FEF59E0000-0x000007FEF63CC000-memory.dmp

                        Filesize

                        9.9MB

                        Download

                      • memory/1740-11-0x000000001AEE6000-0x000000001AEE7000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1740-14-0x000000001AEE8000-0x000000001AEE9000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1740-13-0x000000001AEE7000-0x000000001AEE8000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1740-12-0x000000001AEEA000-0x000000001AEEB000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1800-23-0x00000000766F1000-0x00000000766F3000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/1800-21-0x00000000003E0000-0x00000000003E1000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1800-20-0x00000000741A0000-0x000000007488E000-memory.dmp

                        Filesize

                        6.9MB

                        Download

                      • memory/1876-60-0x00000000048E0000-0x00000000048E1000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1876-7-0x000007FEFBDE1000-0x000007FEFBDE3000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/1900-30-0x0000000000150000-0x0000000000151000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1900-28-0x00000000741A0000-0x000000007488E000-memory.dmp

                        Filesize

                        6.9MB

                        Download

                      • memory/1900-33-0x0000000004C30000-0x0000000004C31000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/2120-63-0x00000000040F0000-0x00000000040F1000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/2244-64-0x0000000000BE0000-0x0000000000BE2000-memory.dmp

                        Filesize

                        8KB

                        Download