Analysis
-
max time kernel
150s -
max time network
11s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
19/06/2021, 12:01
Static task
static1
Behavioral task
behavioral1
Sample
test_redeemer.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
test_redeemer.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
test_redeemer.exe
-
Size
1.8MB
-
MD5
e37a0ece30267233f1dddf3c2300393f
-
SHA1
27610367c41c1b8d3a26885b40fd7aac748189b2
-
SHA256
bb7e2066f53bdbb8e93edfa8e900d5be3e2d00ca0a59f9feaa8b8107db7a5d4d
-
SHA512
a0e5ceafb39f9ad3774d6a250646bae5f5595c1330bef3df7d448778ee519bc35ce221526c1a4d3db88107b5ccf1b465eef11e5b00cfc680bcdb9cea92ba87c2
Score
9/10
Malware Config
Signatures
-
Clears Windows event logs 1 TTPs
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
pid Process 568 sqlservr.exe -
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\PushRedo.png.redeem sqlservr.exe File created C:\Users\Admin\Pictures\MountSwitch.raw.redeem sqlservr.exe File created C:\Users\Admin\Pictures\ResizeComplete.crw.redeem sqlservr.exe File created C:\Users\Admin\Pictures\UninstallBlock.crw.redeem sqlservr.exe File created C:\Users\Admin\Pictures\RegisterRead.png.redeem sqlservr.exe -
Deletes itself 1 IoCs
pid Process 568 sqlservr.exe -
Loads dropped DLL 1 IoCs
pid Process 1832 test_redeemer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 16 IoCs
description ioc Process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini sqlservr.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini sqlservr.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini sqlservr.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini sqlservr.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini sqlservr.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini sqlservr.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini sqlservr.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini sqlservr.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini sqlservr.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini sqlservr.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini sqlservr.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini sqlservr.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini sqlservr.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini sqlservr.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini sqlservr.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini sqlservr.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SQL\ test_redeemer.exe File created C:\Windows\SQL\sqlservr.exe test_redeemer.exe File opened for modification C:\Windows\SQL\sqlservr.exe test_redeemer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 820 vssadmin.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 864 vssvc.exe Token: SeRestorePrivilege 864 vssvc.exe Token: SeAuditPrivilege 864 vssvc.exe Token: SeSecurityPrivilege 1680 wevtutil.exe Token: SeBackupPrivilege 1680 wevtutil.exe Token: SeSecurityPrivilege 1956 wevtutil.exe Token: SeBackupPrivilege 1956 wevtutil.exe Token: SeSecurityPrivilege 1036 wevtutil.exe Token: SeBackupPrivilege 1036 wevtutil.exe Token: SeSecurityPrivilege 832 wevtutil.exe Token: SeBackupPrivilege 832 wevtutil.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe Token: SeTakeOwnershipPrivilege 568 sqlservr.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 1832 wrote to memory of 568 1832 test_redeemer.exe 30 PID 1832 wrote to memory of 568 1832 test_redeemer.exe 30 PID 1832 wrote to memory of 568 1832 test_redeemer.exe 30 PID 1832 wrote to memory of 568 1832 test_redeemer.exe 30 PID 568 wrote to memory of 240 568 sqlservr.exe 32 PID 568 wrote to memory of 240 568 sqlservr.exe 32 PID 568 wrote to memory of 240 568 sqlservr.exe 32 PID 568 wrote to memory of 240 568 sqlservr.exe 32 PID 240 wrote to memory of 820 240 cmd.exe 33 PID 240 wrote to memory of 820 240 cmd.exe 33 PID 240 wrote to memory of 820 240 cmd.exe 33 PID 240 wrote to memory of 820 240 cmd.exe 33 PID 568 wrote to memory of 608 568 sqlservr.exe 35 PID 568 wrote to memory of 608 568 sqlservr.exe 35 PID 568 wrote to memory of 608 568 sqlservr.exe 35 PID 568 wrote to memory of 608 568 sqlservr.exe 35 PID 608 wrote to memory of 1680 608 cmd.exe 36 PID 608 wrote to memory of 1680 608 cmd.exe 36 PID 608 wrote to memory of 1680 608 cmd.exe 36 PID 608 wrote to memory of 1680 608 cmd.exe 36 PID 568 wrote to memory of 1044 568 sqlservr.exe 37 PID 568 wrote to memory of 1044 568 sqlservr.exe 37 PID 568 wrote to memory of 1044 568 sqlservr.exe 37 PID 568 wrote to memory of 1044 568 sqlservr.exe 37 PID 1044 wrote to memory of 1956 1044 cmd.exe 38 PID 1044 wrote to memory of 1956 1044 cmd.exe 38 PID 1044 wrote to memory of 1956 1044 cmd.exe 38 PID 1044 wrote to memory of 1956 1044 cmd.exe 38 PID 568 wrote to memory of 1864 568 sqlservr.exe 39 PID 568 wrote to memory of 1864 568 sqlservr.exe 39 PID 568 wrote to memory of 1864 568 sqlservr.exe 39 PID 568 wrote to memory of 1864 568 sqlservr.exe 39 PID 1864 wrote to memory of 1036 1864 cmd.exe 40 PID 1864 wrote to memory of 1036 1864 cmd.exe 40 PID 1864 wrote to memory of 1036 1864 cmd.exe 40 PID 1864 wrote to memory of 1036 1864 cmd.exe 40 PID 568 wrote to memory of 2032 568 sqlservr.exe 41 PID 568 wrote to memory of 2032 568 sqlservr.exe 41 PID 568 wrote to memory of 2032 568 sqlservr.exe 41 PID 568 wrote to memory of 2032 568 sqlservr.exe 41 PID 2032 wrote to memory of 832 2032 cmd.exe 42 PID 2032 wrote to memory of 832 2032 cmd.exe 42 PID 2032 wrote to memory of 832 2032 cmd.exe 42 PID 2032 wrote to memory of 832 2032 cmd.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\test_redeemer.exe"C:\Users\Admin\AppData\Local\Temp\test_redeemer.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SQL\sqlservr.exe"C:\Windows\SQL\sqlservr.exe" C:\Users\Admin\AppData\Local\Temp\test_redeemer.exe2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Deletes itself
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /All /Quiet3⤵
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /All /Quiet4⤵
- Interacts with shadow copies
PID:820
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wevtutil clear-log Application3⤵
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Windows\SysWOW64\wevtutil.exewevtutil clear-log Application4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1680
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wevtutil clear-log Security3⤵
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\wevtutil.exewevtutil clear-log Security4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1956
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wevtutil clear-log Setup3⤵
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\wevtutil.exewevtutil clear-log Setup4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1036
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wevtutil clear-log System3⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\wevtutil.exewevtutil clear-log System4⤵
- Suspicious use of AdjustPrivilegeToken
PID:832
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:864