Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
14-04-2021 06:06
General
-
Target
8df125c407a6c3e6049125c4a98b890da4f21c8ab14d508557fbb2da8393af3e.bin.sample.exe
-
Size
156KB
-
MD5
158a38fb23353bd53e8e9f505408ef00
-
SHA1
d3e0d5661a9c8f87f72eac9703d572ee42bb4498
-
SHA256
8df125c407a6c3e6049125c4a98b890da4f21c8ab14d508557fbb2da8393af3e
-
SHA512
04c94041b059c96497683d096a07ea757dd964255cfac8ad8e0ddc5c33fbc1611d7e8bcf5e64cda77ffd62da26ae70869eef06e78fcf8503b7adc0caf1c2714f
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 3 IoCs
-
Modifies extensions of user files 44 IoCs
Ransomware generally changes the extension on encrypted files.
-
Possible privilege escalation attempt 2 IoCs
-
Sets service image path in registry 2 TTPs
-
Windows Defender anti-emulation file check 1 TTPs
Defender's emulator always creates certain fake files which can be used to detect it.
-
Deletes itself 1 IoCs
-
Modifies file permissions 1 TTPs 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Discovers systems in the same network 1 TTPs 1 IoCs
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
NTFS ADS 2 IoCs
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of WriteProcessMemory 34 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8df125c407a6c3e6049125c4a98b890da4f21c8ab14d508557fbb2da8393af3e.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\8df125c407a6c3e6049125c4a98b890da4f21c8ab14d508557fbb2da8393af3e.bin.sample.exe"1⤵
- Checks whether UAC is enabled
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\EIN1R3~1:binC:\Users\Admin\AppData\Roaming\EIN1R3~1:bin C:\Users\Admin\AppData\Local\Temp\8DF125~1.EXE2⤵
- Executes dropped EXE
- Deletes itself
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\takeown.exeC:\Windows\system32\takeown.exe /F C:\Windows\System32\vds.exe3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\Windows\System32\vds.exe /reset3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\5NAsKj:binC:\Users\Admin\AppData\Roaming\5NAsKj:bin2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\arp.exeC:\Windows\system32\\arp.exe -a3⤵
-
C:\Windows\system32\nslookup.exeC:\Windows\system32\\nslookup.exe 10.10.0.13⤵
-
C:\Windows\system32\nslookup.exeC:\Windows\system32\\nslookup.exe 10.10.0.303⤵
-
C:\Windows\system32\nslookup.exeC:\Windows\system32\\nslookup.exe 10.10.0.353⤵
-
C:\Windows\system32\nslookup.exeC:\Windows\system32\\nslookup.exe 10.10.0.2553⤵
-
C:\Windows\system32\nslookup.exeC:\Windows\system32\\nslookup.exe 224.0.0.223⤵
-
C:\Windows\system32\nslookup.exeC:\Windows\system32\\nslookup.exe 224.0.0.2523⤵
-
C:\Windows\system32\nslookup.exeC:\Windows\system32\\nslookup.exe 239.255.255.2503⤵
-
C:\Windows\system32\nslookup.exeC:\Windows\system32\\nslookup.exe 255.255.255.2553⤵
-
C:\Windows\system32\net.exeC:\Windows\system32\\net.exe view igmp.mcast.net3⤵
- Discovers systems in the same network
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\5NAsKj:binMD5
158a38fb23353bd53e8e9f505408ef00
SHA1d3e0d5661a9c8f87f72eac9703d572ee42bb4498
SHA2568df125c407a6c3e6049125c4a98b890da4f21c8ab14d508557fbb2da8393af3e
SHA51204c94041b059c96497683d096a07ea757dd964255cfac8ad8e0ddc5c33fbc1611d7e8bcf5e64cda77ffd62da26ae70869eef06e78fcf8503b7adc0caf1c2714f
-
C:\Users\Admin\AppData\Roaming\5NAsKj:binMD5
158a38fb23353bd53e8e9f505408ef00
SHA1d3e0d5661a9c8f87f72eac9703d572ee42bb4498
SHA2568df125c407a6c3e6049125c4a98b890da4f21c8ab14d508557fbb2da8393af3e
SHA51204c94041b059c96497683d096a07ea757dd964255cfac8ad8e0ddc5c33fbc1611d7e8bcf5e64cda77ffd62da26ae70869eef06e78fcf8503b7adc0caf1c2714f
-
C:\Users\Admin\AppData\Roaming\EIN1R3~1:binMD5
158a38fb23353bd53e8e9f505408ef00
SHA1d3e0d5661a9c8f87f72eac9703d572ee42bb4498
SHA2568df125c407a6c3e6049125c4a98b890da4f21c8ab14d508557fbb2da8393af3e
SHA51204c94041b059c96497683d096a07ea757dd964255cfac8ad8e0ddc5c33fbc1611d7e8bcf5e64cda77ffd62da26ae70869eef06e78fcf8503b7adc0caf1c2714f
-
C:\Users\Admin\AppData\Roaming\EIN1R3~1:binMD5
158a38fb23353bd53e8e9f505408ef00
SHA1d3e0d5661a9c8f87f72eac9703d572ee42bb4498
SHA2568df125c407a6c3e6049125c4a98b890da4f21c8ab14d508557fbb2da8393af3e
SHA51204c94041b059c96497683d096a07ea757dd964255cfac8ad8e0ddc5c33fbc1611d7e8bcf5e64cda77ffd62da26ae70869eef06e78fcf8503b7adc0caf1c2714f
-
C:\Windows\System32\vds.exeMD5
158a38fb23353bd53e8e9f505408ef00
SHA1d3e0d5661a9c8f87f72eac9703d572ee42bb4498
SHA2568df125c407a6c3e6049125c4a98b890da4f21c8ab14d508557fbb2da8393af3e
SHA51204c94041b059c96497683d096a07ea757dd964255cfac8ad8e0ddc5c33fbc1611d7e8bcf5e64cda77ffd62da26ae70869eef06e78fcf8503b7adc0caf1c2714f
-
C:\Windows\System32\vds.exeMD5
158a38fb23353bd53e8e9f505408ef00
SHA1d3e0d5661a9c8f87f72eac9703d572ee42bb4498
SHA2568df125c407a6c3e6049125c4a98b890da4f21c8ab14d508557fbb2da8393af3e
SHA51204c94041b059c96497683d096a07ea757dd964255cfac8ad8e0ddc5c33fbc1611d7e8bcf5e64cda77ffd62da26ae70869eef06e78fcf8503b7adc0caf1c2714f
-
memory/496-123-0x0000000000000000-mapping.dmp
-
memory/504-132-0x0000000000000000-mapping.dmp
-
memory/504-145-0x0000000002430000-0x00000000024DE000-memory.dmpFilesize
696KB
-
memory/808-137-0x0000000000000000-mapping.dmp
-
memory/1132-139-0x0000000000000000-mapping.dmp
-
memory/1208-138-0x0000000000000000-mapping.dmp
-
memory/1436-140-0x0000000000000000-mapping.dmp
-
memory/1508-142-0x0000000000000000-mapping.dmp
-
memory/1752-141-0x0000000000000000-mapping.dmp
-
memory/2472-146-0x0000000000000000-mapping.dmp
-
memory/2724-148-0x0000000000000000-mapping.dmp
-
memory/3116-149-0x0000000000000000-mapping.dmp
-
memory/3460-124-0x0000000002570000-0x00000000026BA000-memory.dmpFilesize
1.3MB
-
memory/3460-118-0x0000000000000000-mapping.dmp
-
memory/3984-126-0x0000000000000000-mapping.dmp
-
memory/4016-150-0x0000000000000000-mapping.dmp
-
memory/4192-127-0x0000000000000000-mapping.dmp
-
memory/4292-151-0x0000000000000000-mapping.dmp
-
memory/4656-117-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4656-116-0x0000000002490000-0x0000000002496000-memory.dmpFilesize
24KB