Analysis
-
max time kernel
145s -
max time network
163s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
19-05-2021 13:45
Static task
static1
Behavioral task
behavioral1
Sample
sample.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
sample.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
sample.exe
-
Size
179KB
-
MD5
61fccc142e2bbf498885bb6e42bae62c
-
SHA1
7f15507c7798d8b99696c19929c86c6c629eb2f5
-
SHA256
ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf
-
SHA512
a3cc95a442581d02c97d4fe48494b157f37e5dff4ddf175723a2c99e442492370ad65f9f22da29ffd020754445193215b7dadc3515ab8cee91b6dd3b1f1202b1
Score
8/10
Malware Config
Signatures
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\LimitUnregister.png => C:\Users\Admin\Pictures\LimitUnregister.png.matryoshka sample.exe File renamed C:\Users\Admin\Pictures\PingGet.tif => C:\Users\Admin\Pictures\PingGet.tif.matryoshka sample.exe File renamed C:\Users\Admin\Pictures\StartSend.png => C:\Users\Admin\Pictures\StartSend.png.matryoshka sample.exe File opened for modification C:\Users\Admin\Pictures\TraceMove.tiff sample.exe File renamed C:\Users\Admin\Pictures\TraceMove.tiff => C:\Users\Admin\Pictures\TraceMove.tiff.matryoshka sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml sample.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Background_Loading.png sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_right.gif sample.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Visualizer.zip sample.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_dot.png sample.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\divider-horizontal.png sample.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml sample.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\controllers.js sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\ViewHeaderPreview.jpg sample.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf sample.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\settings.html sample.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\1047x576black.png sample.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-filesystems.xml sample.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\ehshellLogo.png sample.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\about.html sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macTSFrame.png sample.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\2.png sample.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_lrg.png sample.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Newsprint.xml sample.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_close_down_BIDI.png sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Auto.jpg sample.exe File created C:\Program Files (x86)\Windows Media Player\Media Renderer\avtransport.xml sample.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\calendar.html sample.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_thunderstorm.png sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Apothecary.xml sample.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_bottom_left.png sample.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\34.png sample.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonIcon.png sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiling.xml sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.json sample.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_down.png sample.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png sample.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png sample.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_ring_docked.png sample.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\39.png sample.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\drag.png sample.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\delete_up.png sample.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg sample.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-nodes.xml sample.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\slideShow.js sample.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_h.png sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIconImages.jpg sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsPrintTemplate.html sample.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\service.js sample.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi sample.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-backglow.png sample.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html sample.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-down.png sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-attach.xml sample.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\32.png sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.InfoPath.xml sample.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-visual.xml sample.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\settings.js sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_mid_over.gif sample.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main sample.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_Classes\Local Settings rundll32.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1600 NOTEPAD.EXE -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeBackupPrivilege 1716 vssvc.exe Token: SeRestorePrivilege 1716 vssvc.exe Token: SeAuditPrivilege 1716 vssvc.exe Token: 33 1672 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1672 AUDIODG.EXE Token: 33 1672 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1672 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1660 sample.exe 1660 sample.exe 1660 sample.exe 1660 sample.exe 1660 sample.exe 1660 sample.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1280 wrote to memory of 1600 1280 rundll32.exe 37 PID 1280 wrote to memory of 1600 1280 rundll32.exe 37 PID 1280 wrote to memory of 1600 1280 rundll32.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\sample.exe"C:\Users\Admin\AppData\Local\Temp\sample.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1660
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1716
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0xc81⤵
- Suspicious use of AdjustPrivilegeToken
PID:1672
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\SuspendWatch.pps.matryoshka1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\SuspendWatch.pps.matryoshka2⤵
- Opens file in notepad (likely ransom note)
PID:1600
-