Analysis
-
max time kernel
57s -
max time network
111s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-02-2021 18:44
General
-
Target
speedo.bin.exe
-
Size
50KB
-
MD5
e0870a190c5eaefdae56f9c8773e36cd
-
SHA1
a0d2ea755f3914354b76ed895e0024fe753808bc
-
SHA256
1b1172500c6e1e1607b0b0bce4ec74f8b65ffafcd492d8cd2886a7b7f20efaa4
-
SHA512
c68948866b06f2336b4be9ea6ec63daa3573d9a5a8185977e772bfd297a0b7cbf050fd5cc72cb782f53a4ba1bb7d46b683b7a3fcd69e047d0e30899e021efadd
Malware Config
Extracted
C:\Users\Admin\Desktop\info.hta
parasite@cock.li
para5ite@tutanota.com
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 1 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\speedo.bin.exe"C:\Users\Admin\AppData\Local\Temp\speedo.bin.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system32\cmstp.exe"c:\windows\system32\cmstp.exe" /au C:\Windows\temp\p4ivb3aj.inf2⤵
-
C:\Windows\system32\cmd.execmd /c start C:\Windows\temp\gmndk54w.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\gmndk54w.exeC:\Windows\temp\gmndk54w.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\98561.exe"C:\Users\Admin\AppData\Roaming\98561.exe"3⤵
- Executes dropped EXE
- Modifies extensions of user files
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 1 & Del "C:\Users\Admin\AppData\Roaming\98561.exe"4⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 15⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 1 & Del "C:\Windows\temp\gmndk54w.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 14⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\98561.exeMD5
7bd1af2bf9a6444ed8f835886b203495
SHA1a18ede85e2129bea96144a7165a8d49bfc29c3ed
SHA256fa741ee3922bcadce51c42f2ce03bda09cfc96cb7f079a2794f69c98d985ec36
SHA512c5a0c720ff6f90231bb4c376e7e4d2f33517566ddfa84f9dbe31cbac9d63b239babd1002e7fc00440c2182319c26a82f958b88fb59b087f4e2debef7fd9fbfe0
-
C:\Users\Admin\AppData\Roaming\98561.exeMD5
7bd1af2bf9a6444ed8f835886b203495
SHA1a18ede85e2129bea96144a7165a8d49bfc29c3ed
SHA256fa741ee3922bcadce51c42f2ce03bda09cfc96cb7f079a2794f69c98d985ec36
SHA512c5a0c720ff6f90231bb4c376e7e4d2f33517566ddfa84f9dbe31cbac9d63b239babd1002e7fc00440c2182319c26a82f958b88fb59b087f4e2debef7fd9fbfe0
-
C:\Users\Admin\Desktop\info.htaMD5
b4aff40fdf09c3dfb2032c691ccc44d1
SHA1c385515aa61ada509fad5b9f7a7ab9a84ab856e7
SHA256e4e875e65926d9343ff2f4d5490407e3ef9050728c92f5cfa56839eca2081109
SHA5123642499656d403faafdcd5d73a55e9472f2b38a8445bb13db395ce48680b7bd4908a4661c2706a4a8e288ed9617fb5c8045dc01034c70d8f5c233421ec0ff0aa
-
C:\Windows\Temp\gmndk54w.exeMD5
6612016ed61a65144813f238efe491a1
SHA13a77f98b94a92f482c194ef4d57df1ad05d446ad
SHA256affdb2f84b3ae8459618a81731f364775386cd8b39b6ec795c5ae80287fed7cc
SHA5128bffd0759b021b534ba1f7cec57ad7f714c0f189d77b20e363e7de6d77e6c3867dfd0ca1e6c6d8e245252332b5ffff5c49b7ebbc8beb8d5d6c071dafcccada5d
-
C:\Windows\temp\gmndk54w.exeMD5
6612016ed61a65144813f238efe491a1
SHA13a77f98b94a92f482c194ef4d57df1ad05d446ad
SHA256affdb2f84b3ae8459618a81731f364775386cd8b39b6ec795c5ae80287fed7cc
SHA5128bffd0759b021b534ba1f7cec57ad7f714c0f189d77b20e363e7de6d77e6c3867dfd0ca1e6c6d8e245252332b5ffff5c49b7ebbc8beb8d5d6c071dafcccada5d
-
C:\Windows\temp\p4ivb3aj.infMD5
f80666d0a8d2fafcfcfa118aee617fea
SHA10bdf32261cb2bb6b632b0406a4dbc874043f8fcd
SHA256f2ff776705d23c941a0f517dc0273a7b2b17a644e6cbb5caee7948c493a375fa
SHA512e00c450150f70fa102b496fd3ea9d7fbf3845affae82448570dc583f1f81387e0f9bf8ebdb754b928566358ff9543c4cb0a6d02a6f25fdb49f0893940b811ce8
-
memory/640-45-0x0000000000000000-mapping.dmp
-
memory/668-39-0x0000000000000000-mapping.dmp
-
memory/804-31-0x0000000000000000-mapping.dmp
-
memory/856-15-0x0000000073460000-0x0000000073B4E000-memory.dmpFilesize
6.9MB
-
memory/856-16-0x0000000000F00000-0x0000000000F01000-memory.dmpFilesize
4KB
-
memory/856-12-0x0000000000000000-mapping.dmp
-
memory/880-11-0x000000001ACD4000-0x000000001ACD6000-memory.dmpFilesize
8KB
-
memory/880-10-0x000000001ACD2000-0x000000001ACD4000-memory.dmpFilesize
8KB
-
memory/880-9-0x000000001ACD0000-0x000000001ACD2000-memory.dmpFilesize
8KB
-
memory/880-3-0x0000000000040000-0x0000000000041000-memory.dmpFilesize
4KB
-
memory/880-2-0x00007FF9448C0000-0x00007FF9452AC000-memory.dmpFilesize
9.9MB
-
memory/904-47-0x0000000000000000-mapping.dmp
-
memory/988-35-0x0000000000000000-mapping.dmp
-
memory/1092-38-0x0000000000000000-mapping.dmp
-
memory/1192-33-0x0000000000000000-mapping.dmp
-
memory/1196-46-0x0000000000000000-mapping.dmp
-
memory/1628-25-0x0000000000000000-mapping.dmp
-
memory/1760-44-0x0000000000000000-mapping.dmp
-
memory/1768-36-0x0000000000000000-mapping.dmp
-
memory/2084-32-0x0000000000000000-mapping.dmp
-
memory/2732-43-0x0000000000000000-mapping.dmp
-
memory/2784-30-0x0000000000000000-mapping.dmp
-
memory/2852-24-0x00000000057A0000-0x00000000057A1000-memory.dmpFilesize
4KB
-
memory/2852-29-0x00000000054C0000-0x00000000054C1000-memory.dmpFilesize
4KB
-
memory/2852-28-0x0000000005300000-0x0000000005301000-memory.dmpFilesize
4KB
-
memory/2852-22-0x0000000000B10000-0x0000000000B11000-memory.dmpFilesize
4KB
-
memory/2852-21-0x0000000073460000-0x0000000073B4E000-memory.dmpFilesize
6.9MB
-
memory/2852-18-0x0000000000000000-mapping.dmp
-
memory/2852-26-0x0000000005350000-0x0000000005351000-memory.dmpFilesize
4KB
-
memory/2928-40-0x0000000000000000-mapping.dmp
-
memory/3016-41-0x0000000000000000-mapping.dmp
-
memory/3744-8-0x00000241DBF10000-0x00000241DC011000-memory.dmpFilesize
1.0MB
-
memory/3744-7-0x00000241DBF10000-0x00000241DBF11000-memory.dmpFilesize
4KB
-
memory/3744-5-0x0000000000000000-mapping.dmp
-
memory/3860-27-0x0000000000000000-mapping.dmp
-
memory/3940-42-0x0000000000000000-mapping.dmp
-
memory/3992-34-0x0000000000000000-mapping.dmp
-
memory/4032-37-0x0000000000000000-mapping.dmp