Analysis
- max time kernel
32s - max time network
128s - platform
windows10_x64 - resource
win10v20210410 - submitted
26/07/2021, 12:42
Static task
static1
Behavioral task
behavioral1
Sample
8897db876553f942b2eb4005f8475a232bafb82a50ca7761a621842e894a3d80.sample.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
8897db876553f942b2eb4005f8475a232bafb82a50ca7761a621842e894a3d80.sample.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 8897db876553f942b2eb4005f8475a232bafb82a50ca7761a621842e894a3d80.sample.exe
- Size 56KB
- Sample210726-efcm7mx35s
- SHA256 8897db876553f942b2eb4005f8475a232bafb82a50ca7761a621842e894a3d80
- MD5 ecb00e9a61f99a7d4c90723294986bbc
- SHA1 be59c867da75e2a66b8c2519e950254f817cd4ad
- SHA512 9dee79827d865de41a63962b419eed7e1f9610ff27f00f8b7b2b9f51e905d5db907d310da590d8f1a11ac88e549373edf39bffdb44d1b205728f1b5e0a43aa5e
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- WastedLocker
Ransomware family seen in the wild since May 2020.
- Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Executes dropped EXE 2 IoCs
pid Process 4012 Usbflags:bin 4056 Usbflags.exe - Modifies extensions of user files 24 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\OptimizeDebug.tiff.eswasted_info Usbflags.exe File opened for modification C:\Users\Admin\Pictures\OptimizeDebug.tiff.eswasted Usbflags.exe File opened for modification C:\Users\Admin\Pictures\ResolveExpand.tif.eswasted Usbflags.exe File renamed C:\Users\Admin\Pictures\ResumeRename.tif => C:\Users\Admin\Pictures\ResumeRename.tif.eswasted Usbflags.exe File created C:\Users\Admin\Pictures\SyncPing.tif.eswasted_info Usbflags.exe File created C:\Users\Admin\Pictures\UninstallReceive.tif.eswasted_info Usbflags.exe File opened for modification C:\Users\Admin\Pictures\UninstallReceive.tif.eswasted Usbflags.exe File created C:\Users\Admin\Pictures\WatchReceive.tiff.eswasted_info Usbflags.exe File renamed C:\Users\Admin\Pictures\ResolveExpand.tif => C:\Users\Admin\Pictures\ResolveExpand.tif.eswasted Usbflags.exe File created C:\Users\Admin\Pictures\ResumeRename.tif.eswasted_info Usbflags.exe File opened for modification C:\Users\Admin\Pictures\ResumeRename.tif.eswasted Usbflags.exe File renamed C:\Users\Admin\Pictures\SyncPing.tif => C:\Users\Admin\Pictures\SyncPing.tif.eswasted Usbflags.exe File created C:\Users\Admin\Pictures\JoinDisconnect.raw.eswasted_info Usbflags.exe File created C:\Users\Admin\Pictures\RepairGet.tiff.eswasted_info Usbflags.exe File renamed C:\Users\Admin\Pictures\RepairGet.tiff => C:\Users\Admin\Pictures\RepairGet.tiff.eswasted Usbflags.exe File opened for modification C:\Users\Admin\Pictures\RepairGet.tiff.eswasted Usbflags.exe File created C:\Users\Admin\Pictures\ResolveExpand.tif.eswasted_info Usbflags.exe File opened for modification C:\Users\Admin\Pictures\SyncPing.tif.eswasted Usbflags.exe File renamed C:\Users\Admin\Pictures\UninstallReceive.tif => C:\Users\Admin\Pictures\UninstallReceive.tif.eswasted Usbflags.exe File renamed C:\Users\Admin\Pictures\WatchReceive.tiff => C:\Users\Admin\Pictures\WatchReceive.tiff.eswasted Usbflags.exe File opened for modification C:\Users\Admin\Pictures\WatchReceive.tiff.eswasted Usbflags.exe File renamed C:\Users\Admin\Pictures\JoinDisconnect.raw => C:\Users\Admin\Pictures\JoinDisconnect.raw.eswasted Usbflags.exe File opened for modification C:\Users\Admin\Pictures\JoinDisconnect.raw.eswasted Usbflags.exe File renamed C:\Users\Admin\Pictures\OptimizeDebug.tiff => C:\Users\Admin\Pictures\OptimizeDebug.tiff.eswasted Usbflags.exe - Possible privilege escalation attempt 2 IoCs
pid Process 932 takeown.exe 2232 icacls.exe - Modifies file permissions 1 TTPs 2 IoCs
pid Process 932 takeown.exe 2232 icacls.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Usbflags.exe Usbflags:bin File opened for modification C:\Windows\SysWOW64\Usbflags.exe attrib.exe - Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3792 vssadmin.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Usbflags:bin 8897db876553f942b2eb4005f8475a232bafb82a50ca7761a621842e894a3d80.sample.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 2940 vssvc.exe Token: SeRestorePrivilege 2940 vssvc.exe Token: SeAuditPrivilege 2940 vssvc.exe - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 3892 wrote to memory of 4012 3892 8897db876553f942b2eb4005f8475a232bafb82a50ca7761a621842e894a3d80.sample.exe 76 PID 3892 wrote to memory of 4012 3892 8897db876553f942b2eb4005f8475a232bafb82a50ca7761a621842e894a3d80.sample.exe 76 PID 3892 wrote to memory of 4012 3892 8897db876553f942b2eb4005f8475a232bafb82a50ca7761a621842e894a3d80.sample.exe 76 PID 4012 wrote to memory of 3792 4012 Usbflags:bin 77 PID 4012 wrote to memory of 3792 4012 Usbflags:bin 77 PID 4012 wrote to memory of 932 4012 Usbflags:bin 81 PID 4012 wrote to memory of 932 4012 Usbflags:bin 81 PID 4012 wrote to memory of 932 4012 Usbflags:bin 81 PID 4012 wrote to memory of 2232 4012 Usbflags:bin 83 PID 4012 wrote to memory of 2232 4012 Usbflags:bin 83 PID 4012 wrote to memory of 2232 4012 Usbflags:bin 83 PID 4056 wrote to memory of 1544 4056 Usbflags.exe 86 PID 4056 wrote to memory of 1544 4056 Usbflags.exe 86 PID 4056 wrote to memory of 1544 4056 Usbflags.exe 86 PID 4012 wrote to memory of 3672 4012 Usbflags:bin 88 PID 4012 wrote to memory of 3672 4012 Usbflags:bin 88 PID 4012 wrote to memory of 3672 4012 Usbflags:bin 88 PID 1544 wrote to memory of 2136 1544 cmd.exe 90 PID 1544 wrote to memory of 2136 1544 cmd.exe 90 PID 1544 wrote to memory of 2136 1544 cmd.exe 90 PID 3892 wrote to memory of 3972 3892 8897db876553f942b2eb4005f8475a232bafb82a50ca7761a621842e894a3d80.sample.exe 92 PID 3892 wrote to memory of 3972 3892 8897db876553f942b2eb4005f8475a232bafb82a50ca7761a621842e894a3d80.sample.exe 92 PID 3892 wrote to memory of 3972 3892 8897db876553f942b2eb4005f8475a232bafb82a50ca7761a621842e894a3d80.sample.exe 92 PID 3672 wrote to memory of 1188 3672 cmd.exe 93 PID 3672 wrote to memory of 1188 3672 cmd.exe 93 PID 3672 wrote to memory of 1188 3672 cmd.exe 93 PID 3972 wrote to memory of 2396 3972 cmd.exe 94 PID 3972 wrote to memory of 2396 3972 cmd.exe 94 PID 3972 wrote to memory of 2396 3972 cmd.exe 94 PID 1544 wrote to memory of 296 1544 cmd.exe 98 PID 1544 wrote to memory of 296 1544 cmd.exe 98 PID 1544 wrote to memory of 296 1544 cmd.exe 98 PID 3672 wrote to memory of 2064 3672 cmd.exe 99 PID 3672 wrote to memory of 2064 3672 cmd.exe 99 PID 3672 wrote to memory of 2064 3672 cmd.exe 99 PID 3972 wrote to memory of 2312 3972 cmd.exe 100 PID 3972 wrote to memory of 2312 3972 cmd.exe 100 PID 3972 wrote to memory of 2312 3972 cmd.exe 100 - Views/modifies file attributes 1 TTPs 3 IoCs
pid Process 2312 attrib.exe 296 attrib.exe 2064 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8897db876553f942b2eb4005f8475a232bafb82a50ca7761a621842e894a3d80.sample.exe"C:\Users\Admin\AppData\Local\Temp\8897db876553f942b2eb4005f8475a232bafb82a50ca7761a621842e894a3d80.sample.exe"1⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Roaming\Usbflags:binC:\Users\Admin\AppData\Roaming\Usbflags:bin -r2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:3792
-
-
C:\Windows\SysWOW64\takeown.exeC:\Windows\system32\takeown.exe /F C:\Windows\system32\Usbflags.exe3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:932
-
-
C:\Windows\SysWOW64\icacls.exeC:\Windows\system32\icacls.exe C:\Windows\system32\Usbflags.exe /reset3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2232
-
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Roaming\Usbflags" & del "C:\Users\Admin\AppData\Roaming\Usbflags"3⤵
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y4⤵PID:1188
-
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Roaming\Usbflags"4⤵
- Views/modifies file attributes
PID:2064
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\8897db876553f942b2eb4005f8475a232bafb82a50ca7761a621842e894a3d80.sample.exe" & del "C:\Users\Admin\AppData\Local\Temp\8897db876553f942b2eb4005f8475a232bafb82a50ca7761a621842e894a3d80.sample.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵PID:2396
-
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Local\Temp\8897db876553f942b2eb4005f8475a232bafb82a50ca7761a621842e894a3d80.sample.exe"3⤵
- Views/modifies file attributes
PID:2312
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2940
-
C:\Windows\SysWOW64\Usbflags.exeC:\Windows\SysWOW64\Usbflags.exe -s1⤵
- Executes dropped EXE
- Modifies extensions of user files
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Windows\SysWOW64\Usbflags.exe" & del "C:\Windows\SysWOW64\Usbflags.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵PID:2136
-
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Windows\SysWOW64\Usbflags.exe"3⤵
- Drops file in System32 directory
- Views/modifies file attributes
PID:296
-
-