Analysis
-
max time kernel
51s -
max time network
13s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
13-02-2021 10:58
General
-
Target
_$.exe
-
Size
50KB
-
MD5
7c93a02c3a90f915530df1acaa07fec9
-
SHA1
1353fc85e84a431d43e519c8eef3d789b2a84be5
-
SHA256
db5964ee570a1cbcbd1a0c7c8a7e4aadb44f64c27061ab25fde24a7f21d73f45
-
SHA512
e8fa76667098d6d9caf3348dfd784ad68e14f44879d0a25a087486599478debc7f337669e16b444e3e056368faf7036ff39a2c60beb408af4bca2d4d151608f2
Malware Config
Extracted
C:\Users\Admin\Desktop\info.hta
parazite@tutanota.com
alcmalcolm@cock.li
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\_$.exe"C:\Users\Admin\AppData\Local\Temp\_$.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system32\cmstp.exe"c:\windows\system32\cmstp.exe" /au C:\Windows\temp\bbyhmk3v.inf2⤵
-
C:\Windows\system32\cmd.execmd /c start C:\Windows\temp\0wkomrak.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\0wkomrak.exeC:\Windows\temp\0wkomrak.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\TaskHost.exe"C:\Users\Admin\AppData\Roaming\TaskHost.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet4⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete4⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet4⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"4⤵
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 1 & Del "C:\Users\Admin\AppData\Roaming\TaskHost.exe"4⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 15⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 1 & Del "C:\Windows\temp\0wkomrak.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 14⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\TaskHost.exeMD5
a6073d31eb10aaee44fea4aa90627629
SHA14d3711bb9e4162a4651fd53ce3ac25a555ef3a7d
SHA256ae4140e284b0c132c88415bb6ceb195c220668d1c6ad64f72313ffffed8cd0a0
SHA512081d4ad5bdaeaec02ce4d6ab5cad704580b3401ec42eb6b23b31d1f1ffa443e2e2d2970506b8f5b020dcc33bc1b2b5d2ef9ce63d641eb963521f4a0318e65663
-
C:\Users\Admin\AppData\Roaming\TaskHost.exeMD5
a6073d31eb10aaee44fea4aa90627629
SHA14d3711bb9e4162a4651fd53ce3ac25a555ef3a7d
SHA256ae4140e284b0c132c88415bb6ceb195c220668d1c6ad64f72313ffffed8cd0a0
SHA512081d4ad5bdaeaec02ce4d6ab5cad704580b3401ec42eb6b23b31d1f1ffa443e2e2d2970506b8f5b020dcc33bc1b2b5d2ef9ce63d641eb963521f4a0318e65663
-
C:\Users\Admin\Desktop\info.htaMD5
35cbcf33bf56364628ffb0344e81fc00
SHA11491300d8dabcf13c45891fc87428ae9bb0df166
SHA2569814206bbd33890cb228f526da938dd03cbcf018c7c4ad665e6dd85e21bc3e4d
SHA512016385ae00114d39d6ff6f990b8cf33e8fe091cff012ccf673d54f57bdfe5714c7ee443559294846b79c1f746b4834949e7497f25bb85ed4e565b0667d12ad99
-
C:\Windows\Temp\0wkomrak.exeMD5
91ebd9edc1322c6200bef620dea7dde6
SHA1adb5d32b4d03db0f39d2fb5be5769393099cc1fc
SHA2566a2151f059327c592dec77ee158596f4bbb64ded544a3e3be77f2765d02f6597
SHA512d26dae8a8fa0fa244d024192baeb768bd3668a089e236f77f97530b240cea1ddfe51d7a1f53c9ca6593e74db4fc07cddd4c130c29f24d7c0c1e3c6d9d75a30fd
-
C:\Windows\temp\0wkomrak.exeMD5
91ebd9edc1322c6200bef620dea7dde6
SHA1adb5d32b4d03db0f39d2fb5be5769393099cc1fc
SHA2566a2151f059327c592dec77ee158596f4bbb64ded544a3e3be77f2765d02f6597
SHA512d26dae8a8fa0fa244d024192baeb768bd3668a089e236f77f97530b240cea1ddfe51d7a1f53c9ca6593e74db4fc07cddd4c130c29f24d7c0c1e3c6d9d75a30fd
-
C:\Windows\temp\bbyhmk3v.infMD5
186de1fc4f5b0c58fd8b25f0730339d1
SHA18fa2559eaa827130790e3d5811861772ae42e43a
SHA2567609536365498816c0d6dfa37976ca86ef4298f21cf08b8cfbb088dad1f34207
SHA51289479e93fe762705707d2f2ba2440d815aeb8cbac472b4d93c296884d47815ae6c118db526c2f3ca68e493aec5980df475464ae3ececb89e0fa1c75444fcf1c3
-
\Users\Admin\AppData\Roaming\TaskHost.exeMD5
a6073d31eb10aaee44fea4aa90627629
SHA14d3711bb9e4162a4651fd53ce3ac25a555ef3a7d
SHA256ae4140e284b0c132c88415bb6ceb195c220668d1c6ad64f72313ffffed8cd0a0
SHA512081d4ad5bdaeaec02ce4d6ab5cad704580b3401ec42eb6b23b31d1f1ffa443e2e2d2970506b8f5b020dcc33bc1b2b5d2ef9ce63d641eb963521f4a0318e65663
-
memory/660-59-0x0000000000000000-mapping.dmp
-
memory/880-56-0x0000000000000000-mapping.dmp
-
memory/884-63-0x0000000000000000-mapping.dmp
-
memory/940-54-0x0000000000000000-mapping.dmp
-
memory/1064-62-0x0000000000000000-mapping.dmp
-
memory/1108-55-0x0000000000000000-mapping.dmp
-
memory/1172-60-0x0000000000000000-mapping.dmp
-
memory/1320-52-0x0000000000000000-mapping.dmp
-
memory/1332-49-0x0000000000000000-mapping.dmp
-
memory/1440-57-0x0000000000000000-mapping.dmp
-
memory/1444-50-0x0000000000000000-mapping.dmp
-
memory/1444-44-0x0000000000000000-mapping.dmp
-
memory/1484-53-0x0000000000000000-mapping.dmp
-
memory/1616-32-0x0000000074D20000-0x000000007540E000-memory.dmpFilesize
6.9MB
-
memory/1616-33-0x0000000000F10000-0x0000000000F11000-memory.dmpFilesize
4KB
-
memory/1616-35-0x00000000761E1000-0x00000000761E3000-memory.dmpFilesize
8KB
-
memory/1616-29-0x0000000000000000-mapping.dmp
-
memory/1616-48-0x0000000000000000-mapping.dmp
-
memory/1624-43-0x0000000000000000-mapping.dmp
-
memory/1724-22-0x000000001AD8C000-0x000000001AD8D000-memory.dmpFilesize
4KB
-
memory/1724-19-0x000000001AD88000-0x000000001AD89000-memory.dmpFilesize
4KB
-
memory/1724-3-0x00000000011E0000-0x00000000011E1000-memory.dmpFilesize
4KB
-
memory/1724-16-0x000000001AD85000-0x000000001AD86000-memory.dmpFilesize
4KB
-
memory/1724-11-0x000000001AD8B000-0x000000001AD8C000-memory.dmpFilesize
4KB
-
memory/1724-14-0x000000001AD66000-0x000000001AD85000-memory.dmpFilesize
124KB
-
memory/1724-31-0x000000001AD8D000-0x000000001AD8E000-memory.dmpFilesize
4KB
-
memory/1724-10-0x000000001AD60000-0x000000001AD62000-memory.dmpFilesize
8KB
-
memory/1724-17-0x000000001AD86000-0x000000001AD87000-memory.dmpFilesize
4KB
-
memory/1724-2-0x000007FEF6350000-0x000007FEF6D3C000-memory.dmpFilesize
9.9MB
-
memory/1724-21-0x000000001AD8A000-0x000000001AD8B000-memory.dmpFilesize
4KB
-
memory/1724-18-0x000000001AD87000-0x000000001AD88000-memory.dmpFilesize
4KB
-
memory/1724-20-0x000000001AD89000-0x000000001AD8A000-memory.dmpFilesize
4KB
-
memory/1888-51-0x0000000000000000-mapping.dmp
-
memory/1892-61-0x0000000000000000-mapping.dmp
-
memory/1900-7-0x000007FEFC601000-0x000007FEFC603000-memory.dmpFilesize
8KB
-
memory/1900-5-0x0000000000000000-mapping.dmp
-
memory/1916-47-0x0000000000000000-mapping.dmp
-
memory/1920-58-0x0000000000000000-mapping.dmp
-
memory/1948-41-0x00000000013A0000-0x00000000013A1000-memory.dmpFilesize
4KB
-
memory/1948-37-0x0000000000000000-mapping.dmp
-
memory/1948-45-0x0000000001340000-0x0000000001341000-memory.dmpFilesize
4KB
-
memory/1948-40-0x0000000074D20000-0x000000007540E000-memory.dmpFilesize
6.9MB
-
memory/1960-65-0x000007FEF5DF0000-0x000007FEF606A000-memory.dmpFilesize
2.5MB
-
memory/2012-46-0x0000000000000000-mapping.dmp