Analysis
-
max time kernel
95s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-02-2021 10:58
General
-
Target
_$.exe
-
Size
50KB
-
MD5
7c93a02c3a90f915530df1acaa07fec9
-
SHA1
1353fc85e84a431d43e519c8eef3d789b2a84be5
-
SHA256
db5964ee570a1cbcbd1a0c7c8a7e4aadb44f64c27061ab25fde24a7f21d73f45
-
SHA512
e8fa76667098d6d9caf3348dfd784ad68e14f44879d0a25a087486599478debc7f337669e16b444e3e056368faf7036ff39a2c60beb408af4bca2d4d151608f2
Malware Config
Extracted
C:\Users\Admin\Desktop\info.hta
parazite@tutanota.com
alcmalcolm@cock.li
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 1 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\_$.exe"C:\Users\Admin\AppData\Local\Temp\_$.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system32\cmstp.exe"c:\windows\system32\cmstp.exe" /au C:\Windows\temp\30zrxhkv.inf2⤵
-
C:\Windows\system32\cmd.execmd /c start C:\Windows\temp\z4calwqf.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\z4calwqf.exeC:\Windows\temp\z4calwqf.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\TaskHost.exe"C:\Users\Admin\AppData\Roaming\TaskHost.exe"3⤵
- Executes dropped EXE
- Modifies extensions of user files
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 1 & Del "C:\Users\Admin\AppData\Roaming\TaskHost.exe"4⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 15⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 1 & Del "C:\Windows\temp\z4calwqf.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 14⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\TaskHost.exeMD5
a6073d31eb10aaee44fea4aa90627629
SHA14d3711bb9e4162a4651fd53ce3ac25a555ef3a7d
SHA256ae4140e284b0c132c88415bb6ceb195c220668d1c6ad64f72313ffffed8cd0a0
SHA512081d4ad5bdaeaec02ce4d6ab5cad704580b3401ec42eb6b23b31d1f1ffa443e2e2d2970506b8f5b020dcc33bc1b2b5d2ef9ce63d641eb963521f4a0318e65663
-
C:\Users\Admin\AppData\Roaming\TaskHost.exeMD5
a6073d31eb10aaee44fea4aa90627629
SHA14d3711bb9e4162a4651fd53ce3ac25a555ef3a7d
SHA256ae4140e284b0c132c88415bb6ceb195c220668d1c6ad64f72313ffffed8cd0a0
SHA512081d4ad5bdaeaec02ce4d6ab5cad704580b3401ec42eb6b23b31d1f1ffa443e2e2d2970506b8f5b020dcc33bc1b2b5d2ef9ce63d641eb963521f4a0318e65663
-
C:\Users\Admin\Desktop\info.htaMD5
a0e158a308a89132c4aad305e27f0784
SHA1cf334bf9d01dcff9412d249b4aafad911fc15028
SHA256638b0f9ee2dde8f74316b5b5dced64828d056b8944e8cac3a88921576458589d
SHA5121d959f9ed6b048084134ce615bab3ecb4429c906ecd25dec8c2e50fb26270bceabe79039593179a7e91a0d50bb41fb6ac691fe4ab49a00573a02f9f712e7f775
-
C:\Windows\Temp\z4calwqf.exeMD5
91ebd9edc1322c6200bef620dea7dde6
SHA1adb5d32b4d03db0f39d2fb5be5769393099cc1fc
SHA2566a2151f059327c592dec77ee158596f4bbb64ded544a3e3be77f2765d02f6597
SHA512d26dae8a8fa0fa244d024192baeb768bd3668a089e236f77f97530b240cea1ddfe51d7a1f53c9ca6593e74db4fc07cddd4c130c29f24d7c0c1e3c6d9d75a30fd
-
C:\Windows\temp\30zrxhkv.infMD5
c5a5f3714941a6b4f42acb87dc40f6d2
SHA17bbce16eee198ad265b76b6ce98a6b3389170d40
SHA2560ead4918e97fcf67eff46e4e5f599b1f32cbe73f2ba9352c51e56635f358e2b0
SHA51228e5042ba9418941d7c20e63073957fb7116cee83bb89a4581b62b8f9d3177b406b122f37779ac95bb1c8f5e6e3a1541c3089c10e4bb428fb90658d44a47a738
-
C:\Windows\temp\z4calwqf.exeMD5
91ebd9edc1322c6200bef620dea7dde6
SHA1adb5d32b4d03db0f39d2fb5be5769393099cc1fc
SHA2566a2151f059327c592dec77ee158596f4bbb64ded544a3e3be77f2765d02f6597
SHA512d26dae8a8fa0fa244d024192baeb768bd3668a089e236f77f97530b240cea1ddfe51d7a1f53c9ca6593e74db4fc07cddd4c130c29f24d7c0c1e3c6d9d75a30fd
-
memory/356-40-0x0000000000000000-mapping.dmp
-
memory/584-19-0x0000000000000000-mapping.dmp
-
memory/584-23-0x00000000006E0000-0x00000000006E1000-memory.dmpFilesize
4KB
-
memory/584-22-0x0000000074070000-0x000000007475E000-memory.dmpFilesize
6.9MB
-
memory/812-17-0x000000001AF34000-0x000000001AF36000-memory.dmpFilesize
8KB
-
memory/812-16-0x000000001AF32000-0x000000001AF34000-memory.dmpFilesize
8KB
-
memory/812-15-0x000000001AF30000-0x000000001AF32000-memory.dmpFilesize
8KB
-
memory/812-2-0x00007FFB852D0000-0x00007FFB85CBC000-memory.dmpFilesize
9.9MB
-
memory/812-3-0x0000000000380000-0x0000000000381000-memory.dmpFilesize
4KB
-
memory/976-52-0x0000000000000000-mapping.dmp
-
memory/1068-50-0x0000000000000000-mapping.dmp
-
memory/1324-33-0x0000000005730000-0x0000000005731000-memory.dmpFilesize
4KB
-
memory/1324-36-0x0000000005930000-0x0000000005931000-memory.dmpFilesize
4KB
-
memory/1324-29-0x0000000000ED0000-0x0000000000ED1000-memory.dmpFilesize
4KB
-
memory/1324-31-0x0000000005D50000-0x0000000005D51000-memory.dmpFilesize
4KB
-
memory/1324-28-0x0000000074070000-0x000000007475E000-memory.dmpFilesize
6.9MB
-
memory/1324-25-0x0000000000000000-mapping.dmp
-
memory/1324-35-0x0000000005700000-0x0000000005701000-memory.dmpFilesize
4KB
-
memory/1352-54-0x0000000000000000-mapping.dmp
-
memory/1376-32-0x0000000000000000-mapping.dmp
-
memory/2052-45-0x0000000000000000-mapping.dmp
-
memory/2336-42-0x0000000000000000-mapping.dmp
-
memory/2344-38-0x0000000000000000-mapping.dmp
-
memory/2572-46-0x0000000000000000-mapping.dmp
-
memory/3252-48-0x0000000000000000-mapping.dmp
-
memory/3392-43-0x0000000000000000-mapping.dmp
-
memory/3488-47-0x0000000000000000-mapping.dmp
-
memory/3508-44-0x0000000000000000-mapping.dmp
-
memory/3768-37-0x0000000000000000-mapping.dmp
-
memory/3780-9-0x00000217F8610000-0x00000217F8611000-memory.dmpFilesize
4KB
-
memory/3780-12-0x00000217F8670000-0x00000217F8671000-memory.dmpFilesize
4KB
-
memory/3780-7-0x00000217F8610000-0x00000217F8611000-memory.dmpFilesize
4KB
-
memory/3780-5-0x0000000000000000-mapping.dmp
-
memory/3820-41-0x0000000000000000-mapping.dmp
-
memory/3832-49-0x0000000000000000-mapping.dmp
-
memory/3836-53-0x0000000000000000-mapping.dmp
-
memory/3840-51-0x0000000000000000-mapping.dmp
-
memory/3948-34-0x0000000000000000-mapping.dmp
-
memory/3992-39-0x0000000000000000-mapping.dmp