Resubmissions

27-03-2021 08:30

210327-6yyhantnyj 9

27-03-2021 07:28

210327-ap7ddjvm8n 9

Analysis

  • max time kernel
    10s
  • max time network
    8s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    27-03-2021 07:28

General

  • Target

    Control.exe

  • Size

    1.9MB

  • MD5

    d86f451bbff804e59a549f9fb33d6e3f

  • SHA1

    3cb0cb07cc2542f1d98060adccda726ea865db98

  • SHA256

    008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549

  • SHA512

    c86ad7e1d5c445d4de9866faab578b2eb04f72ffef4fac380b7164003471b4b48b09772e735ea15205e2ab4a1f4d194d188cdeb12c7199d0824ddaba393dcaa2

Malware Config

Signatures

  • CryptOne packer 4 IoCs

    Detects CryptOne packer defined in NCC blogpost.

  • Executes dropped EXE 1 IoCs
  • Modifies extensions of user files 16 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Control.exe
    "C:\Users\Admin\AppData\Local\Temp\Control.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Users\Admin\AppData\Roaming\CenterLibrary\Tip
      C:\Users\Admin\AppData\Roaming\CenterLibrary\Tip /go
      2⤵
      • Executes dropped EXE
      • Modifies extensions of user files
      • Suspicious use of WriteProcessMemory
      PID:1684
      • C:\Windows\system32\cmd.exe
        cmd /c waitfor /t 10 pause /d y & attrib -h "C:\Users\Admin\AppData\Roaming\CenterLibrary\Tip" & del "C:\Users\Admin\AppData\Roaming\CenterLibrary\Tip" & rd "C:\Users\Admin\AppData\Roaming\CenterLibrary\"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1892
        • C:\Windows\system32\waitfor.exe
          waitfor /t 10 pause /d y
          4⤵
            PID:1020
          • C:\Windows\system32\attrib.exe
            attrib -h "C:\Users\Admin\AppData\Roaming\CenterLibrary\Tip"
            4⤵
            • Views/modifies file attributes
            PID:268
      • C:\Windows\system32\cmd.exe
        cmd /c waitfor /t 10 pause /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\Control.exe" & del "C:\Users\Admin\AppData\Local\Temp\Control.exe" & rd "C:\Users\Admin\AppData\Local\Temp\"
        2⤵
        • Deletes itself
        • Suspicious use of WriteProcessMemory
        PID:2012
        • C:\Windows\system32\waitfor.exe
          waitfor /t 10 pause /d y
          3⤵
            PID:428
          • C:\Windows\system32\attrib.exe
            attrib -h "C:\Users\Admin\AppData\Local\Temp\Control.exe"
            3⤵
            • Views/modifies file attributes
            PID:1480

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Hidden Files and Directories

      1
      T1158

      Defense Evasion

      Hidden Files and Directories

      1
      T1158

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\CenterLibrary\Tip
        MD5

        d86f451bbff804e59a549f9fb33d6e3f

        SHA1

        3cb0cb07cc2542f1d98060adccda726ea865db98

        SHA256

        008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549

        SHA512

        c86ad7e1d5c445d4de9866faab578b2eb04f72ffef4fac380b7164003471b4b48b09772e735ea15205e2ab4a1f4d194d188cdeb12c7199d0824ddaba393dcaa2

      • C:\Users\Admin\AppData\Roaming\CenterLibrary\Tip
        MD5

        d86f451bbff804e59a549f9fb33d6e3f

        SHA1

        3cb0cb07cc2542f1d98060adccda726ea865db98

        SHA256

        008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549

        SHA512

        c86ad7e1d5c445d4de9866faab578b2eb04f72ffef4fac380b7164003471b4b48b09772e735ea15205e2ab4a1f4d194d188cdeb12c7199d0824ddaba393dcaa2

      • \Users\Admin\AppData\Roaming\CenterLibrary\Tip
        MD5

        d86f451bbff804e59a549f9fb33d6e3f

        SHA1

        3cb0cb07cc2542f1d98060adccda726ea865db98

        SHA256

        008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549

        SHA512

        c86ad7e1d5c445d4de9866faab578b2eb04f72ffef4fac380b7164003471b4b48b09772e735ea15205e2ab4a1f4d194d188cdeb12c7199d0824ddaba393dcaa2

      • \Users\Admin\AppData\Roaming\CenterLibrary\Tip
        MD5

        d86f451bbff804e59a549f9fb33d6e3f

        SHA1

        3cb0cb07cc2542f1d98060adccda726ea865db98

        SHA256

        008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549

        SHA512

        c86ad7e1d5c445d4de9866faab578b2eb04f72ffef4fac380b7164003471b4b48b09772e735ea15205e2ab4a1f4d194d188cdeb12c7199d0824ddaba393dcaa2

      • memory/268-12-0x0000000000000000-mapping.dmp
      • memory/428-11-0x0000000000000000-mapping.dmp
      • memory/1020-10-0x0000000000000000-mapping.dmp
      • memory/1480-13-0x0000000000000000-mapping.dmp
      • memory/1684-4-0x0000000000000000-mapping.dmp
      • memory/1892-8-0x0000000000000000-mapping.dmp
      • memory/2012-9-0x0000000000000000-mapping.dmp
      • memory/2028-6-0x0000000001CE0000-0x0000000001EA0000-memory.dmp
        Filesize

        1.8MB