Analysis
-
max time kernel
36s -
max time network
41s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
21/06/2021, 17:05
Static task
static1
Behavioral task
behavioral1
Sample
sample.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
sample.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
sample.exe
-
Size
81KB
-
MD5
9c543a3b162b8e9317c717892ba47691
-
SHA1
52980b81ca21b6c02793272dea788f18c03c66bf
-
SHA256
d56cfe09f291b11e27b84ede219459ede65652a19596a0b33f8a3ef871236cf5
-
SHA512
502a5390c777c4c8f3848c66b7accc670b0ebbc7947253d8bb2c73e3b55097870f97142088d337c125d0e545a96ac3e06688c81a0f4935541439a7d58d918c04
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\temp\\mbr.exe" sample.exe -
Disables Task Manager via registry modification
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\AssertSave.tif => C:\Users\Admin\Pictures\AssertSave.tif.SLAM sample.exe File opened for modification C:\Users\Admin\Pictures\GrantSplit.tiff sample.exe File renamed C:\Users\Admin\Pictures\MountSplit.tif => C:\Users\Admin\Pictures\MountSplit.tif.SLAM sample.exe File renamed C:\Users\Admin\Pictures\OutRead.crw => C:\Users\Admin\Pictures\OutRead.crw.SLAM sample.exe File opened for modification C:\Users\Admin\Pictures\RedoRemove.tiff sample.exe File renamed C:\Users\Admin\Pictures\RedoRemove.tiff => C:\Users\Admin\Pictures\RedoRemove.tiff.SLAM sample.exe File renamed C:\Users\Admin\Pictures\ResizeUndo.crw => C:\Users\Admin\Pictures\ResizeUndo.crw.SLAM sample.exe File renamed C:\Users\Admin\Pictures\GrantSplit.tiff => C:\Users\Admin\Pictures\GrantSplit.tiff.SLAM sample.exe File renamed C:\Users\Admin\Pictures\RepairResize.tif => C:\Users\Admin\Pictures\RepairResize.tif.SLAM sample.exe File renamed C:\Users\Admin\Pictures\ResolveCheckpoint.png => C:\Users\Admin\Pictures\ResolveCheckpoint.png.SLAM sample.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA sample.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" sample.exe -
Drops desktop.ini file(s) 9 IoCs
description ioc Process File created C:\Users\Admin\Desktop\desktop.ini sample.exe File created C:\Users\Admin\Pictures\desktop.ini sample.exe File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini sample.exe File created C:\Users\Admin\Pictures\Saved Pictures\desktop.ini sample.exe File created C:\Users\Admin\Music\desktop.ini sample.exe File created C:\Users\Admin\Videos\desktop.ini sample.exe File created C:\Users\Admin\OneDrive\desktop.ini sample.exe File created C:\Users\Admin\Downloads\desktop.ini sample.exe File created C:\Users\Admin\Documents\desktop.ini sample.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\Wallpaper = "C:\\temp\\backtrack.jpg" sample.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe 3244 sample.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe Token: SeDebugPrivilege 3244 sample.exe -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" sample.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\sample.exe"C:\Users\Admin\AppData\Local\Temp\sample.exe"1⤵
- Modifies WinLogon for persistence
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3244
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\b2e67d11aa784dacba4ed6b0506c83bf /t 2156 /p 32441⤵PID:3412