Analysis
-
max time kernel
146s -
max time network
133s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
20-04-2021 09:05
Static task
static1
Behavioral task
behavioral1
Sample
download.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
download.exe
Resource
win10v20210408
General
-
Target
download.exe
-
Size
882KB
-
MD5
c65ce4ba6d977022056272ffc86f51d4
-
SHA1
3811485a7d4ad5f551d844b81e15f44f00515cba
-
SHA256
194d34ae7ddcfa9918c1230cda4615d275baf0bb1a2bb2e0c2c5fb70a87ff4fa
-
SHA512
7792da612d84add79a3972f72a9580ab6a72e9624de43d708cf014d391ead9c415b7362853c18b6a855960bb000928a850b71f9a966575db9c2650094edf38d7
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
Processes:
download.exepid process 1352 download.exe -
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
download.exedescription ioc process File renamed C:\Users\Admin\Pictures\ExpandCopy.tiff => C:\Users\Admin\Pictures\ExpandCopy.tiff.1F2jJ download.exe File renamed C:\Users\Admin\Pictures\HideWrite.crw => C:\Users\Admin\Pictures\HideWrite.crw.1F2jJ download.exe File renamed C:\Users\Admin\Pictures\RestoreResize.png => C:\Users\Admin\Pictures\RestoreResize.png.1F2jJ download.exe File renamed C:\Users\Admin\Pictures\SelectUnblock.raw => C:\Users\Admin\Pictures\SelectUnblock.raw.1F2jJ download.exe File renamed C:\Users\Admin\Pictures\StopMeasure.tiff => C:\Users\Admin\Pictures\StopMeasure.tiff.1F2jJ download.exe File renamed C:\Users\Admin\Pictures\UndoDebug.crw => C:\Users\Admin\Pictures\UndoDebug.crw.1F2jJ download.exe File renamed C:\Users\Admin\Pictures\AssertSplit.raw => C:\Users\Admin\Pictures\AssertSplit.raw.1F2jJ download.exe File opened for modification C:\Users\Admin\Pictures\ExpandCopy.tiff download.exe File renamed C:\Users\Admin\Pictures\GetRestart.png => C:\Users\Admin\Pictures\GetRestart.png.1F2jJ download.exe File opened for modification C:\Users\Admin\Pictures\StopMeasure.tiff download.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
download.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\download.exe" download.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run download.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\download.exe" download.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run download.exe -
Processes:
download.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" download.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
download.exedescription ioc process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-2455352368-1077083310-2879168483-1000\desktop.ini download.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
download.exedescription ioc process File opened (read-only) \??\L: download.exe File opened (read-only) \??\N: download.exe File opened (read-only) \??\O: download.exe File opened (read-only) \??\A: download.exe File opened (read-only) \??\B: download.exe File opened (read-only) \??\F: download.exe File opened (read-only) \??\J: download.exe File opened (read-only) \??\X: download.exe File opened (read-only) \??\Y: download.exe File opened (read-only) \??\Z: download.exe File opened (read-only) \??\H: download.exe File opened (read-only) \??\S: download.exe File opened (read-only) \??\U: download.exe File opened (read-only) \??\V: download.exe File opened (read-only) \??\W: download.exe File opened (read-only) \??\E: download.exe File opened (read-only) \??\M: download.exe File opened (read-only) \??\P: download.exe File opened (read-only) \??\T: download.exe File opened (read-only) \??\R: download.exe File opened (read-only) \??\G: download.exe File opened (read-only) \??\I: download.exe File opened (read-only) \??\K: download.exe File opened (read-only) \??\Q: download.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 api.myip.com 6 api.myip.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exevssadmin.exepid process 1072 vssadmin.exe 1524 vssadmin.exe 1904 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
download.exepid process 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe 344 download.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
Processes:
wmic.exevssvc.exewmic.exewmic.exedescription pid process Token: SeIncreaseQuotaPrivilege 924 wmic.exe Token: SeSecurityPrivilege 924 wmic.exe Token: SeTakeOwnershipPrivilege 924 wmic.exe Token: SeLoadDriverPrivilege 924 wmic.exe Token: SeSystemProfilePrivilege 924 wmic.exe Token: SeSystemtimePrivilege 924 wmic.exe Token: SeProfSingleProcessPrivilege 924 wmic.exe Token: SeIncBasePriorityPrivilege 924 wmic.exe Token: SeCreatePagefilePrivilege 924 wmic.exe Token: SeBackupPrivilege 924 wmic.exe Token: SeRestorePrivilege 924 wmic.exe Token: SeShutdownPrivilege 924 wmic.exe Token: SeDebugPrivilege 924 wmic.exe Token: SeSystemEnvironmentPrivilege 924 wmic.exe Token: SeRemoteShutdownPrivilege 924 wmic.exe Token: SeUndockPrivilege 924 wmic.exe Token: SeManageVolumePrivilege 924 wmic.exe Token: 33 924 wmic.exe Token: 34 924 wmic.exe Token: 35 924 wmic.exe Token: SeBackupPrivilege 1264 vssvc.exe Token: SeRestorePrivilege 1264 vssvc.exe Token: SeAuditPrivilege 1264 vssvc.exe Token: SeIncreaseQuotaPrivilege 900 wmic.exe Token: SeSecurityPrivilege 900 wmic.exe Token: SeTakeOwnershipPrivilege 900 wmic.exe Token: SeLoadDriverPrivilege 900 wmic.exe Token: SeSystemProfilePrivilege 900 wmic.exe Token: SeSystemtimePrivilege 900 wmic.exe Token: SeProfSingleProcessPrivilege 900 wmic.exe Token: SeIncBasePriorityPrivilege 900 wmic.exe Token: SeCreatePagefilePrivilege 900 wmic.exe Token: SeBackupPrivilege 900 wmic.exe Token: SeRestorePrivilege 900 wmic.exe Token: SeShutdownPrivilege 900 wmic.exe Token: SeDebugPrivilege 900 wmic.exe Token: SeSystemEnvironmentPrivilege 900 wmic.exe Token: SeRemoteShutdownPrivilege 900 wmic.exe Token: SeUndockPrivilege 900 wmic.exe Token: SeManageVolumePrivilege 900 wmic.exe Token: 33 900 wmic.exe Token: 34 900 wmic.exe Token: 35 900 wmic.exe Token: SeIncreaseQuotaPrivilege 740 wmic.exe Token: SeSecurityPrivilege 740 wmic.exe Token: SeTakeOwnershipPrivilege 740 wmic.exe Token: SeLoadDriverPrivilege 740 wmic.exe Token: SeSystemProfilePrivilege 740 wmic.exe Token: SeSystemtimePrivilege 740 wmic.exe Token: SeProfSingleProcessPrivilege 740 wmic.exe Token: SeIncBasePriorityPrivilege 740 wmic.exe Token: SeCreatePagefilePrivilege 740 wmic.exe Token: SeBackupPrivilege 740 wmic.exe Token: SeRestorePrivilege 740 wmic.exe Token: SeShutdownPrivilege 740 wmic.exe Token: SeDebugPrivilege 740 wmic.exe Token: SeSystemEnvironmentPrivilege 740 wmic.exe Token: SeRemoteShutdownPrivilege 740 wmic.exe Token: SeUndockPrivilege 740 wmic.exe Token: SeManageVolumePrivilege 740 wmic.exe Token: 33 740 wmic.exe Token: 34 740 wmic.exe Token: 35 740 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
download.exetaskeng.exedescription pid process target process PID 344 wrote to memory of 924 344 download.exe wmic.exe PID 344 wrote to memory of 924 344 download.exe wmic.exe PID 344 wrote to memory of 924 344 download.exe wmic.exe PID 344 wrote to memory of 924 344 download.exe wmic.exe PID 344 wrote to memory of 1072 344 download.exe vssadmin.exe PID 344 wrote to memory of 1072 344 download.exe vssadmin.exe PID 344 wrote to memory of 1072 344 download.exe vssadmin.exe PID 344 wrote to memory of 1072 344 download.exe vssadmin.exe PID 344 wrote to memory of 900 344 download.exe wmic.exe PID 344 wrote to memory of 900 344 download.exe wmic.exe PID 344 wrote to memory of 900 344 download.exe wmic.exe PID 344 wrote to memory of 900 344 download.exe wmic.exe PID 344 wrote to memory of 1524 344 download.exe vssadmin.exe PID 344 wrote to memory of 1524 344 download.exe vssadmin.exe PID 344 wrote to memory of 1524 344 download.exe vssadmin.exe PID 344 wrote to memory of 1524 344 download.exe vssadmin.exe PID 344 wrote to memory of 740 344 download.exe wmic.exe PID 344 wrote to memory of 740 344 download.exe wmic.exe PID 344 wrote to memory of 740 344 download.exe wmic.exe PID 344 wrote to memory of 740 344 download.exe wmic.exe PID 344 wrote to memory of 1904 344 download.exe vssadmin.exe PID 344 wrote to memory of 1904 344 download.exe vssadmin.exe PID 344 wrote to memory of 1904 344 download.exe vssadmin.exe PID 344 wrote to memory of 1904 344 download.exe vssadmin.exe PID 864 wrote to memory of 1352 864 taskeng.exe download.exe PID 864 wrote to memory of 1352 864 taskeng.exe download.exe PID 864 wrote to memory of 1352 864 taskeng.exe download.exe PID 864 wrote to memory of 1352 864 taskeng.exe download.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
download.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" download.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" download.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" download.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\download.exe"C:\Users\Admin\AppData\Local\Temp\download.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {F40F1A88-5BD0-4FEF-9566-A47E61FC3502} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\download.exeC:\Users\Admin\AppData\Roaming\Microsoft\download.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\download.exeMD5
c65ce4ba6d977022056272ffc86f51d4
SHA13811485a7d4ad5f551d844b81e15f44f00515cba
SHA256194d34ae7ddcfa9918c1230cda4615d275baf0bb1a2bb2e0c2c5fb70a87ff4fa
SHA5127792da612d84add79a3972f72a9580ab6a72e9624de43d708cf014d391ead9c415b7362853c18b6a855960bb000928a850b71f9a966575db9c2650094edf38d7
-
C:\Users\Admin\AppData\Roaming\Microsoft\download.exeMD5
c65ce4ba6d977022056272ffc86f51d4
SHA13811485a7d4ad5f551d844b81e15f44f00515cba
SHA256194d34ae7ddcfa9918c1230cda4615d275baf0bb1a2bb2e0c2c5fb70a87ff4fa
SHA5127792da612d84add79a3972f72a9580ab6a72e9624de43d708cf014d391ead9c415b7362853c18b6a855960bb000928a850b71f9a966575db9c2650094edf38d7
-
memory/344-61-0x0000000001B50000-0x0000000001C69000-memory.dmpFilesize
1.1MB
-
memory/344-62-0x0000000000400000-0x0000000001B46000-memory.dmpFilesize
23.3MB
-
memory/344-60-0x0000000075211000-0x0000000075213000-memory.dmpFilesize
8KB
-
memory/740-67-0x0000000000000000-mapping.dmp
-
memory/900-65-0x0000000000000000-mapping.dmp
-
memory/924-63-0x0000000000000000-mapping.dmp
-
memory/1072-64-0x0000000000000000-mapping.dmp
-
memory/1352-70-0x0000000000000000-mapping.dmp
-
memory/1352-74-0x0000000000400000-0x0000000001B46000-memory.dmpFilesize
23.3MB
-
memory/1524-66-0x0000000000000000-mapping.dmp
-
memory/1904-68-0x0000000000000000-mapping.dmp