Analysis
-
max time kernel
23s -
max time network
61s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
14-07-2021 19:16
Static task
static1
Behavioral task
behavioral1
Sample
2.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
2.exe
Resource
win10v20210408
General
-
Target
2.exe
-
Size
2.4MB
-
MD5
a1d45a1dfcf0c7b28819d2f3d9f8bd35
-
SHA1
48b754be9094106fa3813c27e0a5e928c006f7ab
-
SHA256
79b9e821bd34d0f1e5572eceb741caca3302cfaa4cfdf97c5ed78450355c4cbf
-
SHA512
6c250f3530d7d246dc656fd1bbac203bb98b3fda83691bb67f95bd99d716a13fb867cebea638578fb9cb1ad482388fe0bfb80f5949b7fb9ac78d354ad72a322b
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\HOW TO RESTORE YOUR FILES.TXT
aid.keepcalm@seznam.cz
aid.keepcalm@protonmail.com
https://tox.chat/
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
2.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\InitializeExport.raw.mosixvdoam 2.exe File renamed C:\Users\Admin\Pictures\StepCompare.png => C:\Users\Admin\Pictures\StepCompare.png.mosixvdoam 2.exe File opened for modification C:\Users\Admin\Pictures\StepCompare.png.mosixvdoam 2.exe File renamed C:\Users\Admin\Pictures\ProtectNew.crw => C:\Users\Admin\Pictures\ProtectNew.crw.mosixvdoam 2.exe File opened for modification C:\Users\Admin\Pictures\ProtectNew.crw.mosixvdoam 2.exe File renamed C:\Users\Admin\Pictures\InitializeExport.raw => C:\Users\Admin\Pictures\InitializeExport.raw.mosixvdoam 2.exe -
Drops startup file 1 IoCs
Processes:
2.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO RESTORE YOUR FILES.TXT 2.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
2.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark.css.mosixvdoam 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00578_.WMF.mosixvdoam 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY01563_.WMF 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15275_.GIF 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00057_.WMF.mosixvdoam 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSPUB.DEV.HXS.mosixvdoam 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\TAB_OFF.GIF.mosixvdoam 2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia 2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-ui.xml.mosixvdoam 2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-compat.xml 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\BUZZ.WAV 2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif 2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_ja.jar.mosixvdoam 2.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-9 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0175428.JPG.mosixvdoam 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Foundry.thmx.mosixvdoam 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL107.XML.mosixvdoam 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactLow.jpg.mosixvdoam 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FORM.JS.mosixvdoam 2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Pangnirtung.mosixvdoam 2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Vladivostok 2.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX8.x3d 2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs.jar.mosixvdoam 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01157_.WMF 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\LASER.WAV 2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_ja.jar 2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_ja.jar.mosixvdoam 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00513_.WMF.mosixvdoam 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR35F.GIF 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\DiscussionToolIconImages.jpg 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Essential.thmx 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Solstice.thmx.mosixvdoam 2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\NOTICE 2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_ja.jar 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101867.BMP.mosixvdoam 2.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0217302.WMF.mosixvdoam 2.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01618_.WMF 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00333_.WMF 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS.DEV_F_COL.HXK.mosixvdoam 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\OUTEX2.ECF.mosixvdoam 2.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\HOW TO RESTORE YOUR FILES.TXT 2.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_PT\HOW TO RESTORE YOUR FILES.TXT 2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Hobart 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT.DEV.HXS 2.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\zipfs.jar 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana.css.mosixvdoam 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\WSS_DocLib.ico 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0212661.WMF.mosixvdoam 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GROOVE_COL.HXC.mosixvdoam 2.exe File opened for modification C:\Program Files\Java\jre7\lib\jce.jar 2.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.STP.mosixvdoam 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099156.JPG 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_center.gif.mosixvdoam 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099172.WMF.mosixvdoam 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341328.JPG.mosixvdoam 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SECRECL.ICO 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR30F.GIF.mosixvdoam 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CALSO11.POC 2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.c.mosixvdoam 2.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jmx.xml 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0233312.WMF.mosixvdoam 2.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN111.XML 2.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 684 vssadmin.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 840 vssvc.exe Token: SeRestorePrivilege 840 vssvc.exe Token: SeAuditPrivilege 840 vssvc.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
2.execmd.execmd.exedescription pid process target process PID 1856 wrote to memory of 2012 1856 2.exe cmd.exe PID 1856 wrote to memory of 2012 1856 2.exe cmd.exe PID 1856 wrote to memory of 2012 1856 2.exe cmd.exe PID 2012 wrote to memory of 1996 2012 cmd.exe sc.exe PID 2012 wrote to memory of 1996 2012 cmd.exe sc.exe PID 2012 wrote to memory of 1996 2012 cmd.exe sc.exe PID 2012 wrote to memory of 1984 2012 cmd.exe findstr.exe PID 2012 wrote to memory of 1984 2012 cmd.exe findstr.exe PID 2012 wrote to memory of 1984 2012 cmd.exe findstr.exe PID 1856 wrote to memory of 900 1856 2.exe cmd.exe PID 1856 wrote to memory of 900 1856 2.exe cmd.exe PID 1856 wrote to memory of 900 1856 2.exe cmd.exe PID 1856 wrote to memory of 316 1856 2.exe cmd.exe PID 1856 wrote to memory of 316 1856 2.exe cmd.exe PID 1856 wrote to memory of 316 1856 2.exe cmd.exe PID 316 wrote to memory of 684 316 cmd.exe vssadmin.exe PID 316 wrote to memory of 684 316 cmd.exe vssadmin.exe PID 316 wrote to memory of 684 316 cmd.exe vssadmin.exe PID 1856 wrote to memory of 1212 1856 2.exe cmd.exe PID 1856 wrote to memory of 1212 1856 2.exe cmd.exe PID 1856 wrote to memory of 1212 1856 2.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\hmgptsamejdtrdovwor.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exeSC QUERY3⤵
-
C:\Windows\system32\findstr.exeFINDSTR SERVICE_NAME3⤵
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\fjiuuddpnldc.bat2⤵
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\digdpxtvyvpxvixjt.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\logcece.bat2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\digdpxtvyvpxvixjt.batMD5
2202e846ba05d7f0bb20adbc5249c359
SHA14115d2d15614503456aea14db61d71a756cc7b8c
SHA2560965cb8ee38adedd9ba06bdad9220a35890c2df0e4c78d0559cd6da653bf740f
SHA512cd6ce6d89a8e5f75724405bc2694b706819c3c554b042075d5eb47fdb75653235160ac8a85e7425a49d98f25b3886faaaec5599bcf66d20bf6115dc3af4ba9c7
-
C:\Users\Admin\AppData\Local\Temp\hmgptsamejdtrdovwor.batMD5
55310bb774fff38cca265dbc70ad6705
SHA1cb8d76e9fd38a0b253056e5f204dab5441fe932b
SHA2561fbdb97893d09d59575c3ef95df3c929fe6b6ddf1b273283e4efadf94cdc802d
SHA51240e5a5e8454ca3eaac36d732550e2c5d869a235e3bbc4d31c4afa038fe4e06f782fa0885e876ad8119be766477fdcc12c1d5d04d53cf6b324e366b5351fc7cd4
-
memory/316-64-0x0000000000000000-mapping.dmp
-
memory/684-66-0x0000000000000000-mapping.dmp
-
memory/900-63-0x0000000000000000-mapping.dmp
-
memory/1212-67-0x0000000000000000-mapping.dmp
-
memory/1984-62-0x0000000000000000-mapping.dmp
-
memory/1996-61-0x0000000000000000-mapping.dmp
-
memory/2012-59-0x0000000000000000-mapping.dmp