Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
26-07-2021 13:00
Behavioral task
behavioral1
Sample
0e061255b12ade5dc10f4ad9aeca9ebe5496d28ed251acb376c66c1d9f405821.sample.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
0e061255b12ade5dc10f4ad9aeca9ebe5496d28ed251acb376c66c1d9f405821.sample.exe
Resource
win10v20210408
General
-
Target
0e061255b12ade5dc10f4ad9aeca9ebe5496d28ed251acb376c66c1d9f405821.sample.exe
-
Size
112KB
-
MD5
d01fc079881dc0d33a88e4f8df1ae7ce
-
SHA1
c40c8848808da12ef78c68de1e6477b862161a43
-
SHA256
0e061255b12ade5dc10f4ad9aeca9ebe5496d28ed251acb376c66c1d9f405821
-
SHA512
83bca79d1f0ac14c6d79685fd192964e7117e8c9c734036abddfdbb068c801ff38027a0812a2499e1d9e528a47af07150cafee27384b5a78b8fc32c23bd21130
Malware Config
Signatures
-
WastedLocker
Ransomware family seen in the wild since May 2020.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Ubpm:bin cryptone C:\Users\Admin\AppData\Roaming\Ubpm:bin cryptone C:\Windows\SysWOW64\Ubpm.exe cryptone C:\Windows\SysWOW64\Ubpm.exe cryptone -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
Processes:
Ubpm:binUbpm.exepid process 1980 Ubpm:bin 1520 Ubpm.exe -
Modifies extensions of user files 15 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
Ubpm.exedescription ioc process File created C:\Users\Admin\Pictures\ReceiveCompare.crw.tcwwasted_info Ubpm.exe File renamed C:\Users\Admin\Pictures\UnblockSuspend.raw => C:\Users\Admin\Pictures\UnblockSuspend.raw.tcwwasted Ubpm.exe File opened for modification C:\Users\Admin\Pictures\UnblockSuspend.raw.tcwwasted Ubpm.exe File renamed C:\Users\Admin\Pictures\UnpublishSync.raw => C:\Users\Admin\Pictures\UnpublishSync.raw.tcwwasted Ubpm.exe File opened for modification C:\Users\Admin\Pictures\UnpublishSync.raw.tcwwasted Ubpm.exe File renamed C:\Users\Admin\Pictures\RenameHide.tiff => C:\Users\Admin\Pictures\RenameHide.tiff.tcwwasted Ubpm.exe File created C:\Users\Admin\Pictures\SplitJoin.tif.tcwwasted_info Ubpm.exe File opened for modification C:\Users\Admin\Pictures\SplitJoin.tif.tcwwasted Ubpm.exe File opened for modification C:\Users\Admin\Pictures\ReceiveCompare.crw.tcwwasted Ubpm.exe File created C:\Users\Admin\Pictures\RenameHide.tiff.tcwwasted_info Ubpm.exe File created C:\Users\Admin\Pictures\UnblockSuspend.raw.tcwwasted_info Ubpm.exe File renamed C:\Users\Admin\Pictures\ReceiveCompare.crw => C:\Users\Admin\Pictures\ReceiveCompare.crw.tcwwasted Ubpm.exe File opened for modification C:\Users\Admin\Pictures\RenameHide.tiff.tcwwasted Ubpm.exe File renamed C:\Users\Admin\Pictures\SplitJoin.tif => C:\Users\Admin\Pictures\SplitJoin.tif.tcwwasted Ubpm.exe File created C:\Users\Admin\Pictures\UnpublishSync.raw.tcwwasted_info Ubpm.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 1248 takeown.exe 880 icacls.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1316 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
0e061255b12ade5dc10f4ad9aeca9ebe5496d28ed251acb376c66c1d9f405821.sample.exepid process 1688 0e061255b12ade5dc10f4ad9aeca9ebe5496d28ed251acb376c66c1d9f405821.sample.exe 1688 0e061255b12ade5dc10f4ad9aeca9ebe5496d28ed251acb376c66c1d9f405821.sample.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 1248 takeown.exe 880 icacls.exe -
Drops file in System32 directory 2 IoCs
Processes:
Ubpm:binattrib.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Ubpm.exe Ubpm:bin File opened for modification C:\Windows\SysWOW64\Ubpm.exe attrib.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1976 vssadmin.exe -
NTFS ADS 1 IoCs
Processes:
0e061255b12ade5dc10f4ad9aeca9ebe5496d28ed251acb376c66c1d9f405821.sample.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Ubpm:bin 0e061255b12ade5dc10f4ad9aeca9ebe5496d28ed251acb376c66c1d9f405821.sample.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1844 vssvc.exe Token: SeRestorePrivilege 1844 vssvc.exe Token: SeAuditPrivilege 1844 vssvc.exe -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
0e061255b12ade5dc10f4ad9aeca9ebe5496d28ed251acb376c66c1d9f405821.sample.exeUbpm:binUbpm.execmd.execmd.execmd.exedescription pid process target process PID 1688 wrote to memory of 1980 1688 0e061255b12ade5dc10f4ad9aeca9ebe5496d28ed251acb376c66c1d9f405821.sample.exe Ubpm:bin PID 1688 wrote to memory of 1980 1688 0e061255b12ade5dc10f4ad9aeca9ebe5496d28ed251acb376c66c1d9f405821.sample.exe Ubpm:bin PID 1688 wrote to memory of 1980 1688 0e061255b12ade5dc10f4ad9aeca9ebe5496d28ed251acb376c66c1d9f405821.sample.exe Ubpm:bin PID 1688 wrote to memory of 1980 1688 0e061255b12ade5dc10f4ad9aeca9ebe5496d28ed251acb376c66c1d9f405821.sample.exe Ubpm:bin PID 1980 wrote to memory of 1976 1980 Ubpm:bin vssadmin.exe PID 1980 wrote to memory of 1976 1980 Ubpm:bin vssadmin.exe PID 1980 wrote to memory of 1976 1980 Ubpm:bin vssadmin.exe PID 1980 wrote to memory of 1976 1980 Ubpm:bin vssadmin.exe PID 1980 wrote to memory of 1248 1980 Ubpm:bin takeown.exe PID 1980 wrote to memory of 1248 1980 Ubpm:bin takeown.exe PID 1980 wrote to memory of 1248 1980 Ubpm:bin takeown.exe PID 1980 wrote to memory of 1248 1980 Ubpm:bin takeown.exe PID 1980 wrote to memory of 880 1980 Ubpm:bin icacls.exe PID 1980 wrote to memory of 880 1980 Ubpm:bin icacls.exe PID 1980 wrote to memory of 880 1980 Ubpm:bin icacls.exe PID 1980 wrote to memory of 880 1980 Ubpm:bin icacls.exe PID 1520 wrote to memory of 1096 1520 Ubpm.exe cmd.exe PID 1520 wrote to memory of 1096 1520 Ubpm.exe cmd.exe PID 1520 wrote to memory of 1096 1520 Ubpm.exe cmd.exe PID 1520 wrote to memory of 1096 1520 Ubpm.exe cmd.exe PID 1096 wrote to memory of 1036 1096 cmd.exe choice.exe PID 1096 wrote to memory of 1036 1096 cmd.exe choice.exe PID 1096 wrote to memory of 1036 1096 cmd.exe choice.exe PID 1096 wrote to memory of 1036 1096 cmd.exe choice.exe PID 1980 wrote to memory of 1840 1980 Ubpm:bin cmd.exe PID 1980 wrote to memory of 1840 1980 Ubpm:bin cmd.exe PID 1980 wrote to memory of 1840 1980 Ubpm:bin cmd.exe PID 1980 wrote to memory of 1840 1980 Ubpm:bin cmd.exe PID 1688 wrote to memory of 1316 1688 0e061255b12ade5dc10f4ad9aeca9ebe5496d28ed251acb376c66c1d9f405821.sample.exe cmd.exe PID 1688 wrote to memory of 1316 1688 0e061255b12ade5dc10f4ad9aeca9ebe5496d28ed251acb376c66c1d9f405821.sample.exe cmd.exe PID 1688 wrote to memory of 1316 1688 0e061255b12ade5dc10f4ad9aeca9ebe5496d28ed251acb376c66c1d9f405821.sample.exe cmd.exe PID 1688 wrote to memory of 1316 1688 0e061255b12ade5dc10f4ad9aeca9ebe5496d28ed251acb376c66c1d9f405821.sample.exe cmd.exe PID 1840 wrote to memory of 1676 1840 cmd.exe choice.exe PID 1840 wrote to memory of 1676 1840 cmd.exe choice.exe PID 1840 wrote to memory of 1676 1840 cmd.exe choice.exe PID 1840 wrote to memory of 1676 1840 cmd.exe choice.exe PID 1316 wrote to memory of 732 1316 cmd.exe choice.exe PID 1316 wrote to memory of 732 1316 cmd.exe choice.exe PID 1316 wrote to memory of 732 1316 cmd.exe choice.exe PID 1316 wrote to memory of 732 1316 cmd.exe choice.exe PID 1096 wrote to memory of 2008 1096 cmd.exe attrib.exe PID 1096 wrote to memory of 2008 1096 cmd.exe attrib.exe PID 1096 wrote to memory of 2008 1096 cmd.exe attrib.exe PID 1096 wrote to memory of 2008 1096 cmd.exe attrib.exe PID 1840 wrote to memory of 1276 1840 cmd.exe attrib.exe PID 1840 wrote to memory of 1276 1840 cmd.exe attrib.exe PID 1840 wrote to memory of 1276 1840 cmd.exe attrib.exe PID 1840 wrote to memory of 1276 1840 cmd.exe attrib.exe PID 1316 wrote to memory of 204 1316 cmd.exe attrib.exe PID 1316 wrote to memory of 204 1316 cmd.exe attrib.exe PID 1316 wrote to memory of 204 1316 cmd.exe attrib.exe PID 1316 wrote to memory of 204 1316 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 3 IoCs
Processes:
attrib.exeattrib.exeattrib.exepid process 2008 attrib.exe 1276 attrib.exe 204 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e061255b12ade5dc10f4ad9aeca9ebe5496d28ed251acb376c66c1d9f405821.sample.exe"C:\Users\Admin\AppData\Local\Temp\0e061255b12ade5dc10f4ad9aeca9ebe5496d28ed251acb376c66c1d9f405821.sample.exe"1⤵
- Loads dropped DLL
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Ubpm:binC:\Users\Admin\AppData\Roaming\Ubpm:bin -r2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\takeown.exeC:\Windows\system32\takeown.exe /F C:\Windows\system32\Ubpm.exe3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exeC:\Windows\system32\icacls.exe C:\Windows\system32\Ubpm.exe /reset3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Roaming\Ubpm" & del "C:\Users\Admin\AppData\Roaming\Ubpm"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y4⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Roaming\Ubpm"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\0e061255b12ade5dc10f4ad9aeca9ebe5496d28ed251acb376c66c1d9f405821.sample.exe" & del "C:\Users\Admin\AppData\Local\Temp\0e061255b12ade5dc10f4ad9aeca9ebe5496d28ed251acb376c66c1d9f405821.sample.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Local\Temp\0e061255b12ade5dc10f4ad9aeca9ebe5496d28ed251acb376c66c1d9f405821.sample.exe"3⤵
- Views/modifies file attributes
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Ubpm.exeC:\Windows\SysWOW64\Ubpm.exe -s1⤵
- Executes dropped EXE
- Modifies extensions of user files
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Windows\SysWOW64\Ubpm.exe" & del "C:\Windows\SysWOW64\Ubpm.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Windows\SysWOW64\Ubpm.exe"3⤵
- Drops file in System32 directory
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Ubpm:binMD5
d01fc079881dc0d33a88e4f8df1ae7ce
SHA1c40c8848808da12ef78c68de1e6477b862161a43
SHA2560e061255b12ade5dc10f4ad9aeca9ebe5496d28ed251acb376c66c1d9f405821
SHA51283bca79d1f0ac14c6d79685fd192964e7117e8c9c734036abddfdbb068c801ff38027a0812a2499e1d9e528a47af07150cafee27384b5a78b8fc32c23bd21130
-
C:\Users\Admin\AppData\Roaming\Ubpm:binMD5
d01fc079881dc0d33a88e4f8df1ae7ce
SHA1c40c8848808da12ef78c68de1e6477b862161a43
SHA2560e061255b12ade5dc10f4ad9aeca9ebe5496d28ed251acb376c66c1d9f405821
SHA51283bca79d1f0ac14c6d79685fd192964e7117e8c9c734036abddfdbb068c801ff38027a0812a2499e1d9e528a47af07150cafee27384b5a78b8fc32c23bd21130
-
C:\Windows\SysWOW64\Ubpm.exeMD5
d01fc079881dc0d33a88e4f8df1ae7ce
SHA1c40c8848808da12ef78c68de1e6477b862161a43
SHA2560e061255b12ade5dc10f4ad9aeca9ebe5496d28ed251acb376c66c1d9f405821
SHA51283bca79d1f0ac14c6d79685fd192964e7117e8c9c734036abddfdbb068c801ff38027a0812a2499e1d9e528a47af07150cafee27384b5a78b8fc32c23bd21130
-
C:\Windows\SysWOW64\Ubpm.exeMD5
d01fc079881dc0d33a88e4f8df1ae7ce
SHA1c40c8848808da12ef78c68de1e6477b862161a43
SHA2560e061255b12ade5dc10f4ad9aeca9ebe5496d28ed251acb376c66c1d9f405821
SHA51283bca79d1f0ac14c6d79685fd192964e7117e8c9c734036abddfdbb068c801ff38027a0812a2499e1d9e528a47af07150cafee27384b5a78b8fc32c23bd21130
-
\Users\Admin\AppData\Roaming\UbpmMD5
a8d0adf0d8c660b8108ab30b925bbd41
SHA1e004730e76c1c80315d09bb2a86b768d2b0edf51
SHA256ef9ce8a463928e8906d5250da35549d1da7c5d7082054be31aa55ead4dd58f54
SHA5125d69b91b87bf37a19700092a28f29c14d32877d73423246385644e45ea0316d6fc175e9a29b33aa667f3594aabf3d7054368d499e63901adf60a264c0d4a3ab2
-
\Users\Admin\AppData\Roaming\UbpmMD5
a8d0adf0d8c660b8108ab30b925bbd41
SHA1e004730e76c1c80315d09bb2a86b768d2b0edf51
SHA256ef9ce8a463928e8906d5250da35549d1da7c5d7082054be31aa55ead4dd58f54
SHA5125d69b91b87bf37a19700092a28f29c14d32877d73423246385644e45ea0316d6fc175e9a29b33aa667f3594aabf3d7054368d499e63901adf60a264c0d4a3ab2
-
memory/204-85-0x0000000000000000-mapping.dmp
-
memory/732-82-0x0000000000000000-mapping.dmp
-
memory/880-73-0x0000000000000000-mapping.dmp
-
memory/1036-78-0x0000000000000000-mapping.dmp
-
memory/1096-77-0x0000000000000000-mapping.dmp
-
memory/1248-71-0x0000000000000000-mapping.dmp
-
memory/1276-84-0x0000000000000000-mapping.dmp
-
memory/1316-80-0x0000000000000000-mapping.dmp
-
memory/1520-76-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1676-81-0x0000000000000000-mapping.dmp
-
memory/1688-60-0x0000000075011000-0x0000000075013000-memory.dmpFilesize
8KB
-
memory/1688-62-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1688-61-0x0000000000220000-0x0000000000232000-memory.dmpFilesize
72KB
-
memory/1840-79-0x0000000000000000-mapping.dmp
-
memory/1976-68-0x0000000000000000-mapping.dmp
-
memory/1980-65-0x0000000000000000-mapping.dmp
-
memory/1980-69-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2008-83-0x0000000000000000-mapping.dmp