Analysis
-
max time kernel
25s -
max time network
55s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
26-07-2021 12:42
Behavioral task
behavioral1
Sample
887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe
Resource
win10v20210410
General
-
Target
887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe
-
Size
1.1MB
-
MD5
6b20ef8fb494cc6e455220356de298d0
-
SHA1
763d356d30e81d1cd15f6bc6a31f96181edb0b8f
-
SHA256
887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d
-
SHA512
ef53b73a911a608439bf929fa66a66fbf015ed274735b91c1d3b08128b14d6514d5514157e541441b9de0827d068c8f514cfd24a3a52fecb2d09764c4fb3311a
Malware Config
Signatures
-
WastedLocker
Ransomware family seen in the wild since May 2020.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Session:bin cryptone C:\Users\Admin\AppData\Roaming\Session:bin cryptone C:\Windows\SysWOW64\Session.exe cryptone C:\Windows\SysWOW64\Session.exe cryptone -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
Processes:
Session:binSession.exepid process 1232 Session:bin 692 Session.exe -
Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
Session.exedescription ioc process File created C:\Users\Admin\Pictures\NewFind.raw.bbawasted_info Session.exe File renamed C:\Users\Admin\Pictures\RedoImport.crw => C:\Users\Admin\Pictures\RedoImport.crw.bbawasted Session.exe File created C:\Users\Admin\Pictures\RenameLimit.tif.bbawasted_info Session.exe File renamed C:\Users\Admin\Pictures\RenameLimit.tif => C:\Users\Admin\Pictures\RenameLimit.tif.bbawasted Session.exe File opened for modification C:\Users\Admin\Pictures\RenameLimit.tif.bbawasted Session.exe File renamed C:\Users\Admin\Pictures\NewFind.raw => C:\Users\Admin\Pictures\NewFind.raw.bbawasted Session.exe File opened for modification C:\Users\Admin\Pictures\NewFind.raw.bbawasted Session.exe File created C:\Users\Admin\Pictures\RedoImport.crw.bbawasted_info Session.exe File opened for modification C:\Users\Admin\Pictures\RedoImport.crw.bbawasted Session.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 1412 takeown.exe 268 icacls.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1668 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exepid process 1088 887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe 1088 887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 1412 takeown.exe 268 icacls.exe -
Drops file in System32 directory 2 IoCs
Processes:
Session:binattrib.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Session.exe Session:bin File opened for modification C:\Windows\SysWOW64\Session.exe attrib.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1992 vssadmin.exe -
NTFS ADS 1 IoCs
Processes:
887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Session:bin 887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1776 vssvc.exe Token: SeRestorePrivilege 1776 vssvc.exe Token: SeAuditPrivilege 1776 vssvc.exe -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exeSession:binSession.execmd.execmd.execmd.exedescription pid process target process PID 1088 wrote to memory of 1232 1088 887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe Session:bin PID 1088 wrote to memory of 1232 1088 887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe Session:bin PID 1088 wrote to memory of 1232 1088 887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe Session:bin PID 1088 wrote to memory of 1232 1088 887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe Session:bin PID 1232 wrote to memory of 1992 1232 Session:bin vssadmin.exe PID 1232 wrote to memory of 1992 1232 Session:bin vssadmin.exe PID 1232 wrote to memory of 1992 1232 Session:bin vssadmin.exe PID 1232 wrote to memory of 1992 1232 Session:bin vssadmin.exe PID 1232 wrote to memory of 1412 1232 Session:bin takeown.exe PID 1232 wrote to memory of 1412 1232 Session:bin takeown.exe PID 1232 wrote to memory of 1412 1232 Session:bin takeown.exe PID 1232 wrote to memory of 1412 1232 Session:bin takeown.exe PID 1232 wrote to memory of 268 1232 Session:bin icacls.exe PID 1232 wrote to memory of 268 1232 Session:bin icacls.exe PID 1232 wrote to memory of 268 1232 Session:bin icacls.exe PID 1232 wrote to memory of 268 1232 Session:bin icacls.exe PID 692 wrote to memory of 1860 692 Session.exe cmd.exe PID 692 wrote to memory of 1860 692 Session.exe cmd.exe PID 692 wrote to memory of 1860 692 Session.exe cmd.exe PID 692 wrote to memory of 1860 692 Session.exe cmd.exe PID 1860 wrote to memory of 292 1860 cmd.exe choice.exe PID 1860 wrote to memory of 292 1860 cmd.exe choice.exe PID 1860 wrote to memory of 292 1860 cmd.exe choice.exe PID 1860 wrote to memory of 292 1860 cmd.exe choice.exe PID 1232 wrote to memory of 952 1232 Session:bin cmd.exe PID 1232 wrote to memory of 952 1232 Session:bin cmd.exe PID 1232 wrote to memory of 952 1232 Session:bin cmd.exe PID 1232 wrote to memory of 952 1232 Session:bin cmd.exe PID 1088 wrote to memory of 1668 1088 887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe cmd.exe PID 1088 wrote to memory of 1668 1088 887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe cmd.exe PID 1088 wrote to memory of 1668 1088 887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe cmd.exe PID 1088 wrote to memory of 1668 1088 887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe cmd.exe PID 952 wrote to memory of 2004 952 cmd.exe choice.exe PID 952 wrote to memory of 2004 952 cmd.exe choice.exe PID 952 wrote to memory of 2004 952 cmd.exe choice.exe PID 952 wrote to memory of 2004 952 cmd.exe choice.exe PID 1668 wrote to memory of 1980 1668 cmd.exe choice.exe PID 1668 wrote to memory of 1980 1668 cmd.exe choice.exe PID 1668 wrote to memory of 1980 1668 cmd.exe choice.exe PID 1668 wrote to memory of 1980 1668 cmd.exe choice.exe PID 1860 wrote to memory of 1196 1860 cmd.exe attrib.exe PID 1860 wrote to memory of 1196 1860 cmd.exe attrib.exe PID 1860 wrote to memory of 1196 1860 cmd.exe attrib.exe PID 1860 wrote to memory of 1196 1860 cmd.exe attrib.exe PID 952 wrote to memory of 1364 952 cmd.exe attrib.exe PID 952 wrote to memory of 1364 952 cmd.exe attrib.exe PID 952 wrote to memory of 1364 952 cmd.exe attrib.exe PID 952 wrote to memory of 1364 952 cmd.exe attrib.exe PID 1668 wrote to memory of 1548 1668 cmd.exe attrib.exe PID 1668 wrote to memory of 1548 1668 cmd.exe attrib.exe PID 1668 wrote to memory of 1548 1668 cmd.exe attrib.exe PID 1668 wrote to memory of 1548 1668 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 3 IoCs
Processes:
attrib.exeattrib.exeattrib.exepid process 1196 attrib.exe 1364 attrib.exe 1548 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe"C:\Users\Admin\AppData\Local\Temp\887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe"1⤵
- Loads dropped DLL
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Session:binC:\Users\Admin\AppData\Roaming\Session:bin -r2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\takeown.exeC:\Windows\system32\takeown.exe /F C:\Windows\system32\Session.exe3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exeC:\Windows\system32\icacls.exe C:\Windows\system32\Session.exe /reset3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Roaming\Session" & del "C:\Users\Admin\AppData\Roaming\Session"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y4⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Roaming\Session"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe" & del "C:\Users\Admin\AppData\Local\Temp\887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Local\Temp\887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d.sample.exe"3⤵
- Views/modifies file attributes
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Session.exeC:\Windows\SysWOW64\Session.exe -s1⤵
- Executes dropped EXE
- Modifies extensions of user files
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Windows\SysWOW64\Session.exe" & del "C:\Windows\SysWOW64\Session.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Windows\SysWOW64\Session.exe"3⤵
- Drops file in System32 directory
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Session:binMD5
6b20ef8fb494cc6e455220356de298d0
SHA1763d356d30e81d1cd15f6bc6a31f96181edb0b8f
SHA256887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d
SHA512ef53b73a911a608439bf929fa66a66fbf015ed274735b91c1d3b08128b14d6514d5514157e541441b9de0827d068c8f514cfd24a3a52fecb2d09764c4fb3311a
-
C:\Users\Admin\AppData\Roaming\Session:binMD5
6b20ef8fb494cc6e455220356de298d0
SHA1763d356d30e81d1cd15f6bc6a31f96181edb0b8f
SHA256887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d
SHA512ef53b73a911a608439bf929fa66a66fbf015ed274735b91c1d3b08128b14d6514d5514157e541441b9de0827d068c8f514cfd24a3a52fecb2d09764c4fb3311a
-
C:\Windows\SysWOW64\Session.exeMD5
6b20ef8fb494cc6e455220356de298d0
SHA1763d356d30e81d1cd15f6bc6a31f96181edb0b8f
SHA256887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d
SHA512ef53b73a911a608439bf929fa66a66fbf015ed274735b91c1d3b08128b14d6514d5514157e541441b9de0827d068c8f514cfd24a3a52fecb2d09764c4fb3311a
-
C:\Windows\SysWOW64\Session.exeMD5
6b20ef8fb494cc6e455220356de298d0
SHA1763d356d30e81d1cd15f6bc6a31f96181edb0b8f
SHA256887aac61771af200f7e58bf0d02cb96d9befa11deda4e448f0a700ccb186ce9d
SHA512ef53b73a911a608439bf929fa66a66fbf015ed274735b91c1d3b08128b14d6514d5514157e541441b9de0827d068c8f514cfd24a3a52fecb2d09764c4fb3311a
-
\Users\Admin\AppData\Roaming\SessionMD5
f4b36bf2bad783478fcbe9c1f9620c9e
SHA1c340ccd703873b353f843f6c50a51f17c037aee6
SHA2565b4711c0e0a819ac8637c0946e5b9fc62b4ba819b1c234a8bff3d499cb268430
SHA512f416d29027a4971e713c546b7cc47e68b98690d59eaaad97be056d05463a3dcea33220b5dae4c40d189e01d5a14cc3c0e45f19a4cc5c6424e67d651cd24300ae
-
\Users\Admin\AppData\Roaming\SessionMD5
f4b36bf2bad783478fcbe9c1f9620c9e
SHA1c340ccd703873b353f843f6c50a51f17c037aee6
SHA2565b4711c0e0a819ac8637c0946e5b9fc62b4ba819b1c234a8bff3d499cb268430
SHA512f416d29027a4971e713c546b7cc47e68b98690d59eaaad97be056d05463a3dcea33220b5dae4c40d189e01d5a14cc3c0e45f19a4cc5c6424e67d651cd24300ae
-
memory/268-72-0x0000000000000000-mapping.dmp
-
memory/292-77-0x0000000000000000-mapping.dmp
-
memory/692-75-0x0000000000400000-0x0000000000516000-memory.dmpFilesize
1.1MB
-
memory/952-78-0x0000000000000000-mapping.dmp
-
memory/1088-62-0x0000000000400000-0x0000000000516000-memory.dmpFilesize
1.1MB
-
memory/1088-61-0x0000000000220000-0x0000000000230000-memory.dmpFilesize
64KB
-
memory/1088-60-0x0000000075EF1000-0x0000000075EF3000-memory.dmpFilesize
8KB
-
memory/1196-82-0x0000000000000000-mapping.dmp
-
memory/1232-65-0x0000000000000000-mapping.dmp
-
memory/1364-83-0x0000000000000000-mapping.dmp
-
memory/1412-70-0x0000000000000000-mapping.dmp
-
memory/1548-84-0x0000000000000000-mapping.dmp
-
memory/1668-79-0x0000000000000000-mapping.dmp
-
memory/1860-76-0x0000000000000000-mapping.dmp
-
memory/1980-81-0x0000000000000000-mapping.dmp
-
memory/1992-68-0x0000000000000000-mapping.dmp
-
memory/2004-80-0x0000000000000000-mapping.dmp