d62702dc15f7812688bd00b483e2d3b54c44593c76ac7118ee85560a7bd3361e

Analysis

max time kernel
12s
max time network
68s
platform
windows10_x64
resource
win10v20210408
submitted
07/05/2021, 03:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

compile by raminhk.exe
Size

6.7MB
MD5

4ce7c1e483beb642f43715a47b96e32b
SHA1

47e02b2248dec9ff925d423374773a585742d0ae
SHA256

d62702dc15f7812688bd00b483e2d3b54c44593c76ac7118ee85560a7bd3361e
SHA512

122def960135c894e28c9f2d8dfb461e74e22efd76b31673b9462a90484eaae9b47d88a7c8f5519f10762960a669cb87ece43315dbf730a0e06e572f03aea3f1

Score

9^/10

evasion persistence ransomware vmprotect

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1268	bcdedit.exe

Disables Task Manager via registry modification
evasion

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\MoveExport.tif => C:\Users\Admin\Pictures\MoveExport.tif.GoNNaCry	compile by raminhk.exe
File renamed	C:\Users\Admin\Pictures\SendConvertFrom.png => C:\Users\Admin\Pictures\SendConvertFrom.png.GoNNaCry	compile by raminhk.exe
File renamed	C:\Users\Admin\Pictures\UnprotectApprove.tif => C:\Users\Admin\Pictures\UnprotectApprove.tif.GoNNaCry	compile by raminhk.exe
File renamed	C:\Users\Admin\Pictures\AddUnlock.tif => C:\Users\Admin\Pictures\AddUnlock.tif.GoNNaCry	compile by raminhk.exe
File renamed	C:\Users\Admin\Pictures\MountStart.png => C:\Users\Admin\Pictures\MountStart.png.GoNNaCry	compile by raminhk.exe

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/856-114-0x0000000000400000-0x0000000001462000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Infected = "528660b16b8a06bdd62ff1615d427726a46f41565e52738b8f23912813a9b410528660b16b8a06bdd62ff1615d427726"	compile by raminhk.exe

Drops desktop.ini file(s) 24 IoCs

description	ioc	Process
File created	C:\Users\Admin\Desktop\desktop.ini	compile by raminhk.exe
File created	C:\Users\Admin\Favorites\Links\desktop.ini	compile by raminhk.exe
File created	C:\Users\Admin\Pictures\desktop.ini	compile by raminhk.exe
File created	C:\Users\Admin\Searches\desktop.ini	compile by raminhk.exe
File created	C:\Users\Public\AccountPictures\desktop.ini	compile by raminhk.exe
File created	C:\Users\Public\Desktop\desktop.ini	compile by raminhk.exe
File created	C:\Users\Public\Music\desktop.ini	compile by raminhk.exe
File created	C:\Users\Admin\Downloads\desktop.ini	compile by raminhk.exe
File created	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	compile by raminhk.exe
File created	C:\Users\Public\Downloads\desktop.ini	compile by raminhk.exe
File created	C:\Users\Public\Videos\desktop.ini	compile by raminhk.exe
File created	C:\Users\Public\desktop.ini	compile by raminhk.exe
File created	C:\Users\Admin\Videos\desktop.ini	compile by raminhk.exe
File created	C:\Users\Admin\Contacts\desktop.ini	compile by raminhk.exe
File created	C:\Users\Admin\Documents\desktop.ini	compile by raminhk.exe
File created	C:\Users\Admin\Favorites\desktop.ini	compile by raminhk.exe
File created	C:\Users\Admin\Links\desktop.ini	compile by raminhk.exe
File created	C:\Users\Admin\OneDrive\desktop.ini	compile by raminhk.exe
File created	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	compile by raminhk.exe
File created	C:\Users\Admin\Saved Games\desktop.ini	compile by raminhk.exe
File created	C:\Users\Public\Documents\desktop.ini	compile by raminhk.exe
File created	C:\Users\Public\Libraries\desktop.ini	compile by raminhk.exe
File created	C:\Users\Admin\Music\desktop.ini	compile by raminhk.exe
File created	C:\Users\Public\Pictures\desktop.ini	compile by raminhk.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2676	tasklist.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3808	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
856	compile by raminhk.exe
856	compile by raminhk.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	2676	tasklist.exe
Token: SeIncreaseQuotaPrivilege	3268	WMIC.exe
Token: SeSecurityPrivilege	3268	WMIC.exe
Token: SeTakeOwnershipPrivilege	3268	WMIC.exe
Token: SeLoadDriverPrivilege	3268	WMIC.exe
Token: SeSystemProfilePrivilege	3268	WMIC.exe
Token: SeSystemtimePrivilege	3268	WMIC.exe
Token: SeProfSingleProcessPrivilege	3268	WMIC.exe
Token: SeIncBasePriorityPrivilege	3268	WMIC.exe
Token: SeCreatePagefilePrivilege	3268	WMIC.exe
Token: SeBackupPrivilege	3268	WMIC.exe
Token: SeRestorePrivilege	3268	WMIC.exe
Token: SeShutdownPrivilege	3268	WMIC.exe
Token: SeDebugPrivilege	3268	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3268	WMIC.exe
Token: SeRemoteShutdownPrivilege	3268	WMIC.exe
Token: SeUndockPrivilege	3268	WMIC.exe
Token: SeManageVolumePrivilege	3268	WMIC.exe
Token: 33	3268	WMIC.exe
Token: 34	3268	WMIC.exe
Token: 35	3268	WMIC.exe
Token: 36	3268	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3268	WMIC.exe
Token: SeSecurityPrivilege	3268	WMIC.exe
Token: SeTakeOwnershipPrivilege	3268	WMIC.exe
Token: SeLoadDriverPrivilege	3268	WMIC.exe
Token: SeSystemProfilePrivilege	3268	WMIC.exe
Token: SeSystemtimePrivilege	3268	WMIC.exe
Token: SeProfSingleProcessPrivilege	3268	WMIC.exe
Token: SeIncBasePriorityPrivilege	3268	WMIC.exe
Token: SeCreatePagefilePrivilege	3268	WMIC.exe
Token: SeBackupPrivilege	3268	WMIC.exe
Token: SeRestorePrivilege	3268	WMIC.exe
Token: SeShutdownPrivilege	3268	WMIC.exe
Token: SeDebugPrivilege	3268	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3268	WMIC.exe
Token: SeRemoteShutdownPrivilege	3268	WMIC.exe
Token: SeUndockPrivilege	3268	WMIC.exe
Token: SeManageVolumePrivilege	3268	WMIC.exe
Token: 33	3268	WMIC.exe
Token: 34	3268	WMIC.exe
Token: 35	3268	WMIC.exe
Token: 36	3268	WMIC.exe
Token: SeBackupPrivilege	2204	vssvc.exe
Token: SeRestorePrivilege	2204	vssvc.exe
Token: SeAuditPrivilege	2204	vssvc.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 2676	856	compile by raminhk.exe	74
PID 856 wrote to memory of 2676	856	compile by raminhk.exe	74
PID 856 wrote to memory of 2268	856	compile by raminhk.exe	78
PID 856 wrote to memory of 2268	856	compile by raminhk.exe	78
PID 2268 wrote to memory of 416	2268	cmd.exe	80
PID 2268 wrote to memory of 416	2268	cmd.exe	80
PID 2268 wrote to memory of 3268	2268	cmd.exe	81
PID 2268 wrote to memory of 3268	2268	cmd.exe	81
PID 856 wrote to memory of 2924	856	compile by raminhk.exe	84
PID 856 wrote to memory of 2924	856	compile by raminhk.exe	84
PID 2924 wrote to memory of 1268	2924	cmd.exe	86
PID 2924 wrote to memory of 1268	2924	cmd.exe	86
PID 856 wrote to memory of 1084	856	compile by raminhk.exe	87
PID 856 wrote to memory of 1084	856	compile by raminhk.exe	87
PID 1084 wrote to memory of 3808	1084	cmd.exe	89
PID 1084 wrote to memory of 3808	1084	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\compile by raminhk.exe
"C:\Users\Admin\AppData\Local\Temp\compile by raminhk.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\system32\tasklist.exe
  tasklist /FO csv
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2676
- C:\Windows\system32\cmd.exe
  cmd /c vssadmin delete shadow /all /quiet & wmic shadowcopy delete & bcdedit /set {default} boostatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -q
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadow /all /quiet
    3⤵
    PID:416
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3268
- C:\Windows\system32\cmd.exe
  cmd /c bcdedit /set {default} recoveryenabled No cmd.exe /C bcdedit /set {default} bootstatuspolicy ignoreallfailures C:\Windows\System32\cmd.exe /C vssadmin.exe Delete Shadows /All Quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1268
- C:\Windows\system32\cmd.exe
  cmd /c REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Windows\system32\reg.exe
    REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:3808

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2204

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/856-115-0x00007FFA1CF40000-0x00007FFA1CF42000-memory.dmp

Filesize
8KB

Download
memory/856-114-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download