Analysis
-
max time kernel
26s -
max time network
17s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
04-05-2021 02:02
Static task
static1
Behavioral task
behavioral1
Sample
1b0c57b4_by_Libranalysis.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
1b0c57b4_by_Libranalysis.exe
Resource
win10v20210408
General
-
Target
1b0c57b4_by_Libranalysis.exe
-
Size
2.2MB
-
MD5
1b0c57b4b2f28b92d0fa8b71b2f1bce5
-
SHA1
85c495a2c17dc5e8fca669c346ab5ec2560853db
-
SHA256
166eec273d472577682b777f9e12b63697db76c21823abf8c228a8b8b506a4b8
-
SHA512
e00795b3fb74c1fe8ed7d9f4698604bb7ab366cd93621174e24acc805a9e82d8d543942032d37ca9d71ad65a6f7e2eb15bfc2084f7ea927aa13307c53c6e9209
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\HOW TO RESTORE YOUR FILES.TXT
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\OptimizeUninstall.crw => C:\Users\Admin\Pictures\OptimizeUninstall.crw.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Users\Admin\Pictures\OptimizeUninstall.crw.yqbdpevbz 1b0c57b4_by_Libranalysis.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO RESTORE YOUR FILES.TXT 1b0c57b4_by_Libranalysis.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiler.xml 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Lagos.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105360.WMF 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN01308_.WMF 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15072_.GIF 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\APPT.CFG 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfontj2d.properties 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105298.WMF.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105490.WMF 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00217_.WMF.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_underline.gif.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099205.WMF 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153514.WMF.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Flow.thmx 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR00.GIF 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_right_over.gif 1b0c57b4_by_Libranalysis.exe File created C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\HOW TO RESTORE YOUR FILES.TXT 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0297749.WMF 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152722.WMF.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152430.WMF 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01742_.GIF.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\FOLDER.ICO.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsColorChart.html.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107314.WMF 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART10.BDR.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105244.WMF 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10268_.GIF.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\ActiveTabImageMask.bmp.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240811.profile.gz.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_ja.properties.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107718.WMF.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21313_.GIF.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01160_.WMF.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105298.WMF 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Apia 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Maroon.css 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\modules\simplexml.luac.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01251_.WMF 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR32B.GIF.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector_1.0.200.v20131115-1210.jar.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00299_.WMF 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00610_.WMF 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\GRIPMASK.BMP 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\TAB_OFF.GIF 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Tabs.accdt 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309585.JPG.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01167_.WMF 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341499.JPG 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL_COL.HXC.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+12.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EN00320_.WMF.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\bg.pak.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0299611.WMF.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-attach.xml.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_ja.jar.yqbdpevbz 1b0c57b4_by_Libranalysis.exe File opened for modification C:\Program Files\Java\jre7\bin\server\Xusage.txt.yqbdpevbz 1b0c57b4_by_Libranalysis.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1112 vssadmin.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1552 vssvc.exe Token: SeRestorePrivilege 1552 vssvc.exe Token: SeAuditPrivilege 1552 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1084 wrote to memory of 1980 1084 1b0c57b4_by_Libranalysis.exe 26 PID 1084 wrote to memory of 1980 1084 1b0c57b4_by_Libranalysis.exe 26 PID 1084 wrote to memory of 1980 1084 1b0c57b4_by_Libranalysis.exe 26 PID 1084 wrote to memory of 1980 1084 1b0c57b4_by_Libranalysis.exe 26 PID 1980 wrote to memory of 1844 1980 cmd.exe 28 PID 1980 wrote to memory of 1844 1980 cmd.exe 28 PID 1980 wrote to memory of 1844 1980 cmd.exe 28 PID 1980 wrote to memory of 1844 1980 cmd.exe 28 PID 1980 wrote to memory of 1804 1980 cmd.exe 29 PID 1980 wrote to memory of 1804 1980 cmd.exe 29 PID 1980 wrote to memory of 1804 1980 cmd.exe 29 PID 1980 wrote to memory of 1804 1980 cmd.exe 29 PID 1084 wrote to memory of 1796 1084 1b0c57b4_by_Libranalysis.exe 30 PID 1084 wrote to memory of 1796 1084 1b0c57b4_by_Libranalysis.exe 30 PID 1084 wrote to memory of 1796 1084 1b0c57b4_by_Libranalysis.exe 30 PID 1084 wrote to memory of 1796 1084 1b0c57b4_by_Libranalysis.exe 30 PID 1084 wrote to memory of 436 1084 1b0c57b4_by_Libranalysis.exe 36 PID 1084 wrote to memory of 436 1084 1b0c57b4_by_Libranalysis.exe 36 PID 1084 wrote to memory of 436 1084 1b0c57b4_by_Libranalysis.exe 36 PID 1084 wrote to memory of 436 1084 1b0c57b4_by_Libranalysis.exe 36 PID 436 wrote to memory of 1112 436 cmd.exe 38 PID 436 wrote to memory of 1112 436 cmd.exe 38 PID 436 wrote to memory of 1112 436 cmd.exe 38 PID 436 wrote to memory of 1112 436 cmd.exe 38 PID 1084 wrote to memory of 2028 1084 1b0c57b4_by_Libranalysis.exe 40 PID 1084 wrote to memory of 2028 1084 1b0c57b4_by_Libranalysis.exe 40 PID 1084 wrote to memory of 2028 1084 1b0c57b4_by_Libranalysis.exe 40 PID 1084 wrote to memory of 2028 1084 1b0c57b4_by_Libranalysis.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b0c57b4_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\1b0c57b4_by_Libranalysis.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\cncsqrrembarcj.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\sc.exeSC QUERY3⤵PID:1844
-
-
C:\Windows\SysWOW64\findstr.exeFINDSTR SERVICE_NAME3⤵PID:1804
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ivgqrsjdtr.bat2⤵PID:1796
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\psmbqayerjhoqd.bat2⤵
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1112
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\vwxsdoslbbwhqtmdqnl.bat2⤵PID:2028
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1552