Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    27-03-2021 20:26

General

  • Target

    Control.exe

  • Size

    1.9MB

  • MD5

    d86f451bbff804e59a549f9fb33d6e3f

  • SHA1

    3cb0cb07cc2542f1d98060adccda726ea865db98

  • SHA256

    008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549

  • SHA512

    c86ad7e1d5c445d4de9866faab578b2eb04f72ffef4fac380b7164003471b4b48b09772e735ea15205e2ab4a1f4d194d188cdeb12c7199d0824ddaba393dcaa2

Malware Config

Signatures

  • CryptOne packer 4 IoCs

    Detects CryptOne packer defined in NCC blogpost.

  • Executes dropped EXE 1 IoCs
  • Modifies extensions of user files 8 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Control.exe
    "C:\Users\Admin\AppData\Local\Temp\Control.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:528
    • C:\Users\Admin\AppData\Roaming\MediaDial\Draw
      C:\Users\Admin\AppData\Roaming\MediaDial\Draw /go
      2⤵
      • Executes dropped EXE
      • Modifies extensions of user files
      • Suspicious use of WriteProcessMemory
      PID:660
      • C:\Windows\system32\cmd.exe
        cmd /c waitfor /t 10 pause /d y & attrib -h "C:\Users\Admin\AppData\Roaming\MediaDial\Draw" & del "C:\Users\Admin\AppData\Roaming\MediaDial\Draw" & rd "C:\Users\Admin\AppData\Roaming\MediaDial\"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1260
        • C:\Windows\system32\waitfor.exe
          waitfor /t 10 pause /d y
          4⤵
            PID:1284
          • C:\Windows\system32\attrib.exe
            attrib -h "C:\Users\Admin\AppData\Roaming\MediaDial\Draw"
            4⤵
            • Views/modifies file attributes
            PID:1896
      • C:\Windows\system32\cmd.exe
        cmd /c waitfor /t 10 pause /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\Control.exe" & del "C:\Users\Admin\AppData\Local\Temp\Control.exe" & rd "C:\Users\Admin\AppData\Local\Temp\"
        2⤵
        • Deletes itself
        • Suspicious use of WriteProcessMemory
        PID:1380
        • C:\Windows\system32\waitfor.exe
          waitfor /t 10 pause /d y
          3⤵
            PID:1368
          • C:\Windows\system32\attrib.exe
            attrib -h "C:\Users\Admin\AppData\Local\Temp\Control.exe"
            3⤵
            • Views/modifies file attributes
            PID:908

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Hidden Files and Directories

      1
      T1158

      Defense Evasion

      Hidden Files and Directories

      1
      T1158

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\MediaDial\Draw
        MD5

        d86f451bbff804e59a549f9fb33d6e3f

        SHA1

        3cb0cb07cc2542f1d98060adccda726ea865db98

        SHA256

        008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549

        SHA512

        c86ad7e1d5c445d4de9866faab578b2eb04f72ffef4fac380b7164003471b4b48b09772e735ea15205e2ab4a1f4d194d188cdeb12c7199d0824ddaba393dcaa2

      • C:\Users\Admin\AppData\Roaming\MediaDial\Draw
        MD5

        d86f451bbff804e59a549f9fb33d6e3f

        SHA1

        3cb0cb07cc2542f1d98060adccda726ea865db98

        SHA256

        008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549

        SHA512

        c86ad7e1d5c445d4de9866faab578b2eb04f72ffef4fac380b7164003471b4b48b09772e735ea15205e2ab4a1f4d194d188cdeb12c7199d0824ddaba393dcaa2

      • \Users\Admin\AppData\Roaming\MediaDial\Draw
        MD5

        d86f451bbff804e59a549f9fb33d6e3f

        SHA1

        3cb0cb07cc2542f1d98060adccda726ea865db98

        SHA256

        008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549

        SHA512

        c86ad7e1d5c445d4de9866faab578b2eb04f72ffef4fac380b7164003471b4b48b09772e735ea15205e2ab4a1f4d194d188cdeb12c7199d0824ddaba393dcaa2

      • \Users\Admin\AppData\Roaming\MediaDial\Draw
        MD5

        d86f451bbff804e59a549f9fb33d6e3f

        SHA1

        3cb0cb07cc2542f1d98060adccda726ea865db98

        SHA256

        008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549

        SHA512

        c86ad7e1d5c445d4de9866faab578b2eb04f72ffef4fac380b7164003471b4b48b09772e735ea15205e2ab4a1f4d194d188cdeb12c7199d0824ddaba393dcaa2

      • memory/528-6-0x0000000001DC0000-0x0000000001F80000-memory.dmp
        Filesize

        1.8MB

      • memory/660-4-0x0000000000000000-mapping.dmp
      • memory/908-13-0x0000000000000000-mapping.dmp
      • memory/1260-8-0x0000000000000000-mapping.dmp
      • memory/1284-10-0x0000000000000000-mapping.dmp
      • memory/1368-11-0x0000000000000000-mapping.dmp
      • memory/1380-9-0x0000000000000000-mapping.dmp
      • memory/1896-12-0x0000000000000000-mapping.dmp