Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
18-03-2021 18:40
Behavioral task
behavioral1
Sample
db665f26dbc4ca92d326f2cb98faafb9e84d404346b201cd88bec91ce4206bb2.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
db665f26dbc4ca92d326f2cb98faafb9e84d404346b201cd88bec91ce4206bb2.exe
Resource
win10v20201028
General
-
Target
db665f26dbc4ca92d326f2cb98faafb9e84d404346b201cd88bec91ce4206bb2.exe
-
Size
1.2MB
-
MD5
82d841869e912a772413bb37f30307b0
-
SHA1
b75ab0170c1206c345d2fb82506e816098328ee8
-
SHA256
db665f26dbc4ca92d326f2cb98faafb9e84d404346b201cd88bec91ce4206bb2
-
SHA512
48078796a9aa03e685bebd14539586c099f30c3a1e18639d4acb810dc3bbb0dc14b09066797e79c34dcd91a120b08537aadf228585e226101384ade3fe2252c6
Malware Config
Signatures
-
WastedLocker
Ransomware family seen in the wild since May 2020.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Ubpm:bin cryptone C:\Users\Admin\AppData\Roaming\Ubpm:bin cryptone C:\Windows\SysWOW64\Ubpm.exe cryptone C:\Windows\SysWOW64\Ubpm.exe cryptone -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
Processes:
Ubpm:binUbpm.exepid process 1284 Ubpm:bin 1844 Ubpm.exe -
Modifies extensions of user files 21 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
Ubpm.exedescription ioc process File created C:\Users\Admin\Pictures\RevokeRepair.crw.howto_seccrypt Ubpm.exe File opened for modification C:\Users\Admin\Pictures\ConvertToResume.raw.seccrypt Ubpm.exe File created C:\Users\Admin\Pictures\OptimizeMerge.tiff.howto_seccrypt Ubpm.exe File renamed C:\Users\Admin\Pictures\OptimizeMerge.tiff => C:\Users\Admin\Pictures\OptimizeMerge.tiff.seccrypt Ubpm.exe File opened for modification C:\Users\Admin\Pictures\OptimizeMerge.tiff.seccrypt Ubpm.exe File created C:\Users\Admin\Pictures\RequestTest.raw.howto_seccrypt Ubpm.exe File opened for modification C:\Users\Admin\Pictures\RequestTest.raw.seccrypt Ubpm.exe File opened for modification C:\Users\Admin\Pictures\EnterWatch.crw.seccrypt Ubpm.exe File renamed C:\Users\Admin\Pictures\RequestTest.raw => C:\Users\Admin\Pictures\RequestTest.raw.seccrypt Ubpm.exe File opened for modification C:\Users\Admin\Pictures\RevokeRepair.crw.seccrypt Ubpm.exe File created C:\Users\Admin\Pictures\StartJoin.png.howto_seccrypt Ubpm.exe File renamed C:\Users\Admin\Pictures\RevokeRepair.crw => C:\Users\Admin\Pictures\RevokeRepair.crw.seccrypt Ubpm.exe File renamed C:\Users\Admin\Pictures\StartJoin.png => C:\Users\Admin\Pictures\StartJoin.png.seccrypt Ubpm.exe File created C:\Users\Admin\Pictures\UndoOptimize.tiff.howto_seccrypt Ubpm.exe File renamed C:\Users\Admin\Pictures\UndoOptimize.tiff => C:\Users\Admin\Pictures\UndoOptimize.tiff.seccrypt Ubpm.exe File created C:\Users\Admin\Pictures\ConvertToResume.raw.howto_seccrypt Ubpm.exe File renamed C:\Users\Admin\Pictures\ConvertToResume.raw => C:\Users\Admin\Pictures\ConvertToResume.raw.seccrypt Ubpm.exe File created C:\Users\Admin\Pictures\EnterWatch.crw.howto_seccrypt Ubpm.exe File renamed C:\Users\Admin\Pictures\EnterWatch.crw => C:\Users\Admin\Pictures\EnterWatch.crw.seccrypt Ubpm.exe File opened for modification C:\Users\Admin\Pictures\StartJoin.png.seccrypt Ubpm.exe File opened for modification C:\Users\Admin\Pictures\UndoOptimize.tiff.seccrypt Ubpm.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 800 takeown.exe 1816 icacls.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1916 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
db665f26dbc4ca92d326f2cb98faafb9e84d404346b201cd88bec91ce4206bb2.exepid process 1968 db665f26dbc4ca92d326f2cb98faafb9e84d404346b201cd88bec91ce4206bb2.exe 1968 db665f26dbc4ca92d326f2cb98faafb9e84d404346b201cd88bec91ce4206bb2.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 800 takeown.exe 1816 icacls.exe -
Drops file in System32 directory 2 IoCs
Processes:
Ubpm:binattrib.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Ubpm.exe Ubpm:bin File opened for modification C:\Windows\SysWOW64\Ubpm.exe attrib.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1612 vssadmin.exe -
NTFS ADS 1 IoCs
Processes:
db665f26dbc4ca92d326f2cb98faafb9e84d404346b201cd88bec91ce4206bb2.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Ubpm:bin db665f26dbc4ca92d326f2cb98faafb9e84d404346b201cd88bec91ce4206bb2.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1652 vssvc.exe Token: SeRestorePrivilege 1652 vssvc.exe Token: SeAuditPrivilege 1652 vssvc.exe -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
db665f26dbc4ca92d326f2cb98faafb9e84d404346b201cd88bec91ce4206bb2.exeUbpm:binUbpm.execmd.execmd.execmd.exedescription pid process target process PID 1968 wrote to memory of 1284 1968 db665f26dbc4ca92d326f2cb98faafb9e84d404346b201cd88bec91ce4206bb2.exe Ubpm:bin PID 1968 wrote to memory of 1284 1968 db665f26dbc4ca92d326f2cb98faafb9e84d404346b201cd88bec91ce4206bb2.exe Ubpm:bin PID 1968 wrote to memory of 1284 1968 db665f26dbc4ca92d326f2cb98faafb9e84d404346b201cd88bec91ce4206bb2.exe Ubpm:bin PID 1968 wrote to memory of 1284 1968 db665f26dbc4ca92d326f2cb98faafb9e84d404346b201cd88bec91ce4206bb2.exe Ubpm:bin PID 1284 wrote to memory of 1612 1284 Ubpm:bin vssadmin.exe PID 1284 wrote to memory of 1612 1284 Ubpm:bin vssadmin.exe PID 1284 wrote to memory of 1612 1284 Ubpm:bin vssadmin.exe PID 1284 wrote to memory of 1612 1284 Ubpm:bin vssadmin.exe PID 1284 wrote to memory of 800 1284 Ubpm:bin takeown.exe PID 1284 wrote to memory of 800 1284 Ubpm:bin takeown.exe PID 1284 wrote to memory of 800 1284 Ubpm:bin takeown.exe PID 1284 wrote to memory of 800 1284 Ubpm:bin takeown.exe PID 1284 wrote to memory of 1816 1284 Ubpm:bin icacls.exe PID 1284 wrote to memory of 1816 1284 Ubpm:bin icacls.exe PID 1284 wrote to memory of 1816 1284 Ubpm:bin icacls.exe PID 1284 wrote to memory of 1816 1284 Ubpm:bin icacls.exe PID 1844 wrote to memory of 436 1844 Ubpm.exe cmd.exe PID 1844 wrote to memory of 436 1844 Ubpm.exe cmd.exe PID 1844 wrote to memory of 436 1844 Ubpm.exe cmd.exe PID 1844 wrote to memory of 436 1844 Ubpm.exe cmd.exe PID 436 wrote to memory of 1528 436 cmd.exe choice.exe PID 436 wrote to memory of 1528 436 cmd.exe choice.exe PID 436 wrote to memory of 1528 436 cmd.exe choice.exe PID 436 wrote to memory of 1528 436 cmd.exe choice.exe PID 1284 wrote to memory of 1452 1284 Ubpm:bin cmd.exe PID 1284 wrote to memory of 1452 1284 Ubpm:bin cmd.exe PID 1284 wrote to memory of 1452 1284 Ubpm:bin cmd.exe PID 1284 wrote to memory of 1452 1284 Ubpm:bin cmd.exe PID 1968 wrote to memory of 1916 1968 db665f26dbc4ca92d326f2cb98faafb9e84d404346b201cd88bec91ce4206bb2.exe cmd.exe PID 1968 wrote to memory of 1916 1968 db665f26dbc4ca92d326f2cb98faafb9e84d404346b201cd88bec91ce4206bb2.exe cmd.exe PID 1968 wrote to memory of 1916 1968 db665f26dbc4ca92d326f2cb98faafb9e84d404346b201cd88bec91ce4206bb2.exe cmd.exe PID 1968 wrote to memory of 1916 1968 db665f26dbc4ca92d326f2cb98faafb9e84d404346b201cd88bec91ce4206bb2.exe cmd.exe PID 1452 wrote to memory of 1240 1452 cmd.exe choice.exe PID 1452 wrote to memory of 1240 1452 cmd.exe choice.exe PID 1452 wrote to memory of 1240 1452 cmd.exe choice.exe PID 1452 wrote to memory of 1240 1452 cmd.exe choice.exe PID 1916 wrote to memory of 704 1916 cmd.exe choice.exe PID 1916 wrote to memory of 704 1916 cmd.exe choice.exe PID 1916 wrote to memory of 704 1916 cmd.exe choice.exe PID 1916 wrote to memory of 704 1916 cmd.exe choice.exe PID 436 wrote to memory of 1704 436 cmd.exe attrib.exe PID 436 wrote to memory of 1704 436 cmd.exe attrib.exe PID 436 wrote to memory of 1704 436 cmd.exe attrib.exe PID 436 wrote to memory of 1704 436 cmd.exe attrib.exe PID 1452 wrote to memory of 1668 1452 cmd.exe attrib.exe PID 1452 wrote to memory of 1668 1452 cmd.exe attrib.exe PID 1452 wrote to memory of 1668 1452 cmd.exe attrib.exe PID 1452 wrote to memory of 1668 1452 cmd.exe attrib.exe PID 1916 wrote to memory of 932 1916 cmd.exe attrib.exe PID 1916 wrote to memory of 932 1916 cmd.exe attrib.exe PID 1916 wrote to memory of 932 1916 cmd.exe attrib.exe PID 1916 wrote to memory of 932 1916 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 3 IoCs
Processes:
attrib.exeattrib.exeattrib.exepid process 1704 attrib.exe 1668 attrib.exe 932 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\db665f26dbc4ca92d326f2cb98faafb9e84d404346b201cd88bec91ce4206bb2.exe"C:\Users\Admin\AppData\Local\Temp\db665f26dbc4ca92d326f2cb98faafb9e84d404346b201cd88bec91ce4206bb2.exe"1⤵
- Loads dropped DLL
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Ubpm:binC:\Users\Admin\AppData\Roaming\Ubpm:bin -r2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\takeown.exeC:\Windows\system32\takeown.exe /F C:\Windows\system32\Ubpm.exe3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exeC:\Windows\system32\icacls.exe C:\Windows\system32\Ubpm.exe /reset3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Roaming\Ubpm" & del "C:\Users\Admin\AppData\Roaming\Ubpm"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y4⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Roaming\Ubpm"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\db665f26dbc4ca92d326f2cb98faafb9e84d404346b201cd88bec91ce4206bb2.exe" & del "C:\Users\Admin\AppData\Local\Temp\db665f26dbc4ca92d326f2cb98faafb9e84d404346b201cd88bec91ce4206bb2.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Local\Temp\db665f26dbc4ca92d326f2cb98faafb9e84d404346b201cd88bec91ce4206bb2.exe"3⤵
- Views/modifies file attributes
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Ubpm.exeC:\Windows\SysWOW64\Ubpm.exe -s1⤵
- Executes dropped EXE
- Modifies extensions of user files
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Windows\SysWOW64\Ubpm.exe" & del "C:\Windows\SysWOW64\Ubpm.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Windows\SysWOW64\Ubpm.exe"3⤵
- Drops file in System32 directory
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Ubpm:binMD5
82d841869e912a772413bb37f30307b0
SHA1b75ab0170c1206c345d2fb82506e816098328ee8
SHA256db665f26dbc4ca92d326f2cb98faafb9e84d404346b201cd88bec91ce4206bb2
SHA51248078796a9aa03e685bebd14539586c099f30c3a1e18639d4acb810dc3bbb0dc14b09066797e79c34dcd91a120b08537aadf228585e226101384ade3fe2252c6
-
C:\Users\Admin\AppData\Roaming\Ubpm:binMD5
82d841869e912a772413bb37f30307b0
SHA1b75ab0170c1206c345d2fb82506e816098328ee8
SHA256db665f26dbc4ca92d326f2cb98faafb9e84d404346b201cd88bec91ce4206bb2
SHA51248078796a9aa03e685bebd14539586c099f30c3a1e18639d4acb810dc3bbb0dc14b09066797e79c34dcd91a120b08537aadf228585e226101384ade3fe2252c6
-
C:\Windows\SysWOW64\Ubpm.exeMD5
82d841869e912a772413bb37f30307b0
SHA1b75ab0170c1206c345d2fb82506e816098328ee8
SHA256db665f26dbc4ca92d326f2cb98faafb9e84d404346b201cd88bec91ce4206bb2
SHA51248078796a9aa03e685bebd14539586c099f30c3a1e18639d4acb810dc3bbb0dc14b09066797e79c34dcd91a120b08537aadf228585e226101384ade3fe2252c6
-
C:\Windows\SysWOW64\Ubpm.exeMD5
82d841869e912a772413bb37f30307b0
SHA1b75ab0170c1206c345d2fb82506e816098328ee8
SHA256db665f26dbc4ca92d326f2cb98faafb9e84d404346b201cd88bec91ce4206bb2
SHA51248078796a9aa03e685bebd14539586c099f30c3a1e18639d4acb810dc3bbb0dc14b09066797e79c34dcd91a120b08537aadf228585e226101384ade3fe2252c6
-
\Users\Admin\AppData\Roaming\UbpmMD5
df3f24f1a6bb661593e8e2ea6f7a786a
SHA1093afb37365d6af5e39b96f9fe1f89ff892d6f76
SHA256ad9cb0fa1ae581ca32a3ec89d4aa5af96181356c27cd53b27bdae6031c03a656
SHA512342ea316bcd461cad73b5f9b595f8497401d05f9b9aef0050f7fafd1cc7997fe5093b73c4f6d583cf51c568bd83ed9f0add6c1d8c1f64231f7695ce70352f9b9
-
\Users\Admin\AppData\Roaming\UbpmMD5
df3f24f1a6bb661593e8e2ea6f7a786a
SHA1093afb37365d6af5e39b96f9fe1f89ff892d6f76
SHA256ad9cb0fa1ae581ca32a3ec89d4aa5af96181356c27cd53b27bdae6031c03a656
SHA512342ea316bcd461cad73b5f9b595f8497401d05f9b9aef0050f7fafd1cc7997fe5093b73c4f6d583cf51c568bd83ed9f0add6c1d8c1f64231f7695ce70352f9b9
-
memory/436-21-0x0000000000000000-mapping.dmp
-
memory/704-26-0x0000000000000000-mapping.dmp
-
memory/800-14-0x0000000000000000-mapping.dmp
-
memory/932-29-0x0000000000000000-mapping.dmp
-
memory/1240-25-0x0000000000000000-mapping.dmp
-
memory/1284-5-0x0000000000000000-mapping.dmp
-
memory/1452-23-0x0000000000000000-mapping.dmp
-
memory/1528-22-0x0000000000000000-mapping.dmp
-
memory/1612-8-0x0000000000000000-mapping.dmp
-
memory/1668-28-0x0000000000000000-mapping.dmp
-
memory/1704-27-0x0000000000000000-mapping.dmp
-
memory/1816-16-0x0000000000000000-mapping.dmp
-
memory/1916-24-0x0000000000000000-mapping.dmp
-
memory/1968-2-0x0000000075ED1000-0x0000000075ED3000-memory.dmpFilesize
8KB
-
memory/1968-10-0x0000000000400000-0x0000000000411000-memory.dmpFilesize
68KB
-
memory/1968-9-0x00000000001B0000-0x00000000001C0000-memory.dmpFilesize
64KB