6577119386435584.zip

General
Target

008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549.exe

Filesize

1MB

Completed

29-03-2021 09:47

Score
9 /10
MD5

d86f451bbff804e59a549f9fb33d6e3f

SHA1

3cb0cb07cc2542f1d98060adccda726ea865db98

SHA256

008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549

Malware Config
Signatures 7

Filter: none

Defense Evasion
  • CryptOne packer

    Description

    Detects CryptOne packer defined in NCC blogpost.

    Reported IOCs

    resourceyara_rule
    behavioral1/files/0x00030000000130da-2.datcryptone
    behavioral1/files/0x00030000000130da-3.datcryptone
    behavioral1/files/0x00030000000130da-5.datcryptone
    behavioral1/files/0x00030000000130da-13.datcryptone
  • Executes dropped EXE
    Tip

    Reported IOCs

    pidprocess
    1768Tip
  • Modifies extensions of user files
    Tip

    Description

    Ransomware generally changes the extension on encrypted files.

    Tags

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Users\Admin\Pictures\MergeFormat.raw.phoenixTip
    File renamedC:\Users\Admin\Pictures\UpdateGrant.crw => C:\Users\Admin\Pictures\UpdateGrant.crw.phoenixTip
    File opened for modificationC:\Users\Admin\Pictures\UpdateGrant.crw.phoenixTip
    File renamedC:\Users\Admin\Pictures\MergeFormat.raw => C:\Users\Admin\Pictures\MergeFormat.raw.phoenixTip
  • Deletes itself
    cmd.exe

    Reported IOCs

    pidprocess
    1660cmd.exe
  • Loads dropped DLL
    008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549.exe

    Reported IOCs

    pidprocess
    1740008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549.exe
    1740008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549.exe
  • Suspicious use of WriteProcessMemory
    008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549.exeTipcmd.execmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1740 wrote to memory of 17681740008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549.exeTip
    PID 1740 wrote to memory of 17681740008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549.exeTip
    PID 1740 wrote to memory of 17681740008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549.exeTip
    PID 1768 wrote to memory of 16921768Tipcmd.exe
    PID 1768 wrote to memory of 16921768Tipcmd.exe
    PID 1768 wrote to memory of 16921768Tipcmd.exe
    PID 1740 wrote to memory of 16601740008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549.execmd.exe
    PID 1740 wrote to memory of 16601740008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549.execmd.exe
    PID 1740 wrote to memory of 16601740008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549.execmd.exe
    PID 1692 wrote to memory of 11041692cmd.exewaitfor.exe
    PID 1692 wrote to memory of 11041692cmd.exewaitfor.exe
    PID 1692 wrote to memory of 11041692cmd.exewaitfor.exe
    PID 1660 wrote to memory of 10921660cmd.exewaitfor.exe
    PID 1660 wrote to memory of 10921660cmd.exewaitfor.exe
    PID 1660 wrote to memory of 10921660cmd.exewaitfor.exe
    PID 1692 wrote to memory of 2681692cmd.exeattrib.exe
    PID 1692 wrote to memory of 2681692cmd.exeattrib.exe
    PID 1692 wrote to memory of 2681692cmd.exeattrib.exe
    PID 1660 wrote to memory of 8521660cmd.exeattrib.exe
    PID 1660 wrote to memory of 8521660cmd.exeattrib.exe
    PID 1660 wrote to memory of 8521660cmd.exeattrib.exe
  • Views/modifies file attributes
    attrib.exeattrib.exe

    Tags

    TTPs

    Hidden Files and Directories

    Reported IOCs

    pidprocess
    268attrib.exe
    852attrib.exe
Processes 8
  • C:\Users\Admin\AppData\Local\Temp\008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549.exe
    "C:\Users\Admin\AppData\Local\Temp\008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549.exe"
    Loads dropped DLL
    Suspicious use of WriteProcessMemory
    PID:1740
    • C:\Users\Admin\AppData\Roaming\CenterLibrary\Tip
      C:\Users\Admin\AppData\Roaming\CenterLibrary\Tip /go
      Executes dropped EXE
      Modifies extensions of user files
      Suspicious use of WriteProcessMemory
      PID:1768
      • C:\Windows\system32\cmd.exe
        cmd /c waitfor /t 10 pause /d y & attrib -h "C:\Users\Admin\AppData\Roaming\CenterLibrary\Tip" & del "C:\Users\Admin\AppData\Roaming\CenterLibrary\Tip" & rd "C:\Users\Admin\AppData\Roaming\CenterLibrary\"
        Suspicious use of WriteProcessMemory
        PID:1692
        • C:\Windows\system32\waitfor.exe
          waitfor /t 10 pause /d y
          PID:1104
        • C:\Windows\system32\attrib.exe
          attrib -h "C:\Users\Admin\AppData\Roaming\CenterLibrary\Tip"
          Views/modifies file attributes
          PID:268
    • C:\Windows\system32\cmd.exe
      cmd /c waitfor /t 10 pause /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549.exe" & del "C:\Users\Admin\AppData\Local\Temp\008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549.exe" & rd "C:\Users\Admin\AppData\Local\Temp\"
      Deletes itself
      Suspicious use of WriteProcessMemory
      PID:1660
      • C:\Windows\system32\waitfor.exe
        waitfor /t 10 pause /d y
        PID:1092
      • C:\Windows\system32\attrib.exe
        attrib -h "C:\Users\Admin\AppData\Local\Temp\008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549.exe"
        Views/modifies file attributes
        PID:852
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • C:\Users\Admin\AppData\Roaming\CenterLibrary\Tip

                          MD5

                          d86f451bbff804e59a549f9fb33d6e3f

                          SHA1

                          3cb0cb07cc2542f1d98060adccda726ea865db98

                          SHA256

                          008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549

                          SHA512

                          c86ad7e1d5c445d4de9866faab578b2eb04f72ffef4fac380b7164003471b4b48b09772e735ea15205e2ab4a1f4d194d188cdeb12c7199d0824ddaba393dcaa2

                        • C:\Users\Admin\AppData\Roaming\CenterLibrary\Tip

                          MD5

                          d86f451bbff804e59a549f9fb33d6e3f

                          SHA1

                          3cb0cb07cc2542f1d98060adccda726ea865db98

                          SHA256

                          008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549

                          SHA512

                          c86ad7e1d5c445d4de9866faab578b2eb04f72ffef4fac380b7164003471b4b48b09772e735ea15205e2ab4a1f4d194d188cdeb12c7199d0824ddaba393dcaa2

                        • \Users\Admin\AppData\Roaming\CenterLibrary\Tip

                          MD5

                          d86f451bbff804e59a549f9fb33d6e3f

                          SHA1

                          3cb0cb07cc2542f1d98060adccda726ea865db98

                          SHA256

                          008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549

                          SHA512

                          c86ad7e1d5c445d4de9866faab578b2eb04f72ffef4fac380b7164003471b4b48b09772e735ea15205e2ab4a1f4d194d188cdeb12c7199d0824ddaba393dcaa2

                        • \Users\Admin\AppData\Roaming\CenterLibrary\Tip

                          MD5

                          d86f451bbff804e59a549f9fb33d6e3f

                          SHA1

                          3cb0cb07cc2542f1d98060adccda726ea865db98

                          SHA256

                          008ec79765325200361d9c93ac35edd430f8b17894ff843268caa5acd6224549

                          SHA512

                          c86ad7e1d5c445d4de9866faab578b2eb04f72ffef4fac380b7164003471b4b48b09772e735ea15205e2ab4a1f4d194d188cdeb12c7199d0824ddaba393dcaa2

                        • memory/268-12-0x0000000000000000-mapping.dmp

                        • memory/852-14-0x0000000000000000-mapping.dmp

                        • memory/1092-11-0x0000000000000000-mapping.dmp

                        • memory/1104-10-0x0000000000000000-mapping.dmp

                        • memory/1660-9-0x0000000000000000-mapping.dmp

                        • memory/1692-8-0x0000000000000000-mapping.dmp

                        • memory/1740-6-0x0000000001CA0000-0x0000000001E60000-memory.dmp

                        • memory/1768-4-0x0000000000000000-mapping.dmp