Analysis
-
max time kernel
144s -
max time network
177s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
22-08-2021 06:46
Static task
static1
Behavioral task
behavioral1
Sample
f9dfdce85f83d7a416ecc162a9f68643357b1fd10ea29e6b2cd934b967192a74.bin.bin.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
f9dfdce85f83d7a416ecc162a9f68643357b1fd10ea29e6b2cd934b967192a74.bin.bin.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
f9dfdce85f83d7a416ecc162a9f68643357b1fd10ea29e6b2cd934b967192a74.bin.bin.exe
-
Size
351KB
-
MD5
345d140139d2d11713b06f1cd9a5669e
-
SHA1
ca3c843964caa54471c136e8fc36bcb3534c1432
-
SHA256
f9dfdce85f83d7a416ecc162a9f68643357b1fd10ea29e6b2cd934b967192a74
-
SHA512
4e2f2424bb47bbb93972b37fa2657d51f43a5061c7318637cda56bb48ea5fde4277f6a06a4b9e7855a20adbd1eb7ba2444686550fed624428986dc30ea9245c9
Score
10/10
Malware Config
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
f9dfdce85f83d7a416ecc162a9f68643357b1fd10ea29e6b2cd934b967192a74.bin.bin.exedescription ioc Process File renamed C:\Users\Admin\Pictures\ConvertFromExport.raw => C:\Users\Admin\Pictures\ConvertFromExport.raw.hWIno f9dfdce85f83d7a416ecc162a9f68643357b1fd10ea29e6b2cd934b967192a74.bin.bin.exe File renamed C:\Users\Admin\Pictures\FormatHide.raw => C:\Users\Admin\Pictures\FormatHide.raw.E5gFW f9dfdce85f83d7a416ecc162a9f68643357b1fd10ea29e6b2cd934b967192a74.bin.bin.exe File renamed C:\Users\Admin\Pictures\MergeShow.tif => C:\Users\Admin\Pictures\MergeShow.tif.lXxUQg f9dfdce85f83d7a416ecc162a9f68643357b1fd10ea29e6b2cd934b967192a74.bin.bin.exe File renamed C:\Users\Admin\Pictures\SplitInstall.crw => C:\Users\Admin\Pictures\SplitInstall.crw.TfwCXmI f9dfdce85f83d7a416ecc162a9f68643357b1fd10ea29e6b2cd934b967192a74.bin.bin.exe -
Drops startup file 2 IoCs
Processes:
f9dfdce85f83d7a416ecc162a9f68643357b1fd10ea29e6b2cd934b967192a74.bin.bin.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.html f9dfdce85f83d7a416ecc162a9f68643357b1fd10ea29e6b2cd934b967192a74.bin.bin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pd6quiok.dat f9dfdce85f83d7a416ecc162a9f68643357b1fd10ea29e6b2cd934b967192a74.bin.bin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
f9dfdce85f83d7a416ecc162a9f68643357b1fd10ea29e6b2cd934b967192a74.bin.bin.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\123456789.bmp" f9dfdce85f83d7a416ecc162a9f68643357b1fd10ea29e6b2cd934b967192a74.bin.bin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
f9dfdce85f83d7a416ecc162a9f68643357b1fd10ea29e6b2cd934b967192a74.bin.bin.exepid Process 1700 f9dfdce85f83d7a416ecc162a9f68643357b1fd10ea29e6b2cd934b967192a74.bin.bin.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wmic.exevssvc.exewmic.exedescription pid Process Token: SeIncreaseQuotaPrivilege 888 wmic.exe Token: SeSecurityPrivilege 888 wmic.exe Token: SeTakeOwnershipPrivilege 888 wmic.exe Token: SeLoadDriverPrivilege 888 wmic.exe Token: SeSystemProfilePrivilege 888 wmic.exe Token: SeSystemtimePrivilege 888 wmic.exe Token: SeProfSingleProcessPrivilege 888 wmic.exe Token: SeIncBasePriorityPrivilege 888 wmic.exe Token: SeCreatePagefilePrivilege 888 wmic.exe Token: SeBackupPrivilege 888 wmic.exe Token: SeRestorePrivilege 888 wmic.exe Token: SeShutdownPrivilege 888 wmic.exe Token: SeDebugPrivilege 888 wmic.exe Token: SeSystemEnvironmentPrivilege 888 wmic.exe Token: SeRemoteShutdownPrivilege 888 wmic.exe Token: SeUndockPrivilege 888 wmic.exe Token: SeManageVolumePrivilege 888 wmic.exe Token: 33 888 wmic.exe Token: 34 888 wmic.exe Token: 35 888 wmic.exe Token: SeIncreaseQuotaPrivilege 888 wmic.exe Token: SeSecurityPrivilege 888 wmic.exe Token: SeTakeOwnershipPrivilege 888 wmic.exe Token: SeLoadDriverPrivilege 888 wmic.exe Token: SeSystemProfilePrivilege 888 wmic.exe Token: SeSystemtimePrivilege 888 wmic.exe Token: SeProfSingleProcessPrivilege 888 wmic.exe Token: SeIncBasePriorityPrivilege 888 wmic.exe Token: SeCreatePagefilePrivilege 888 wmic.exe Token: SeBackupPrivilege 888 wmic.exe Token: SeRestorePrivilege 888 wmic.exe Token: SeShutdownPrivilege 888 wmic.exe Token: SeDebugPrivilege 888 wmic.exe Token: SeSystemEnvironmentPrivilege 888 wmic.exe Token: SeRemoteShutdownPrivilege 888 wmic.exe Token: SeUndockPrivilege 888 wmic.exe Token: SeManageVolumePrivilege 888 wmic.exe Token: 33 888 wmic.exe Token: 34 888 wmic.exe Token: 35 888 wmic.exe Token: SeBackupPrivilege 1064 vssvc.exe Token: SeRestorePrivilege 1064 vssvc.exe Token: SeAuditPrivilege 1064 vssvc.exe Token: SeIncreaseQuotaPrivilege 1392 wmic.exe Token: SeSecurityPrivilege 1392 wmic.exe Token: SeTakeOwnershipPrivilege 1392 wmic.exe Token: SeLoadDriverPrivilege 1392 wmic.exe Token: SeSystemProfilePrivilege 1392 wmic.exe Token: SeSystemtimePrivilege 1392 wmic.exe Token: SeProfSingleProcessPrivilege 1392 wmic.exe Token: SeIncBasePriorityPrivilege 1392 wmic.exe Token: SeCreatePagefilePrivilege 1392 wmic.exe Token: SeBackupPrivilege 1392 wmic.exe Token: SeRestorePrivilege 1392 wmic.exe Token: SeShutdownPrivilege 1392 wmic.exe Token: SeDebugPrivilege 1392 wmic.exe Token: SeSystemEnvironmentPrivilege 1392 wmic.exe Token: SeRemoteShutdownPrivilege 1392 wmic.exe Token: SeUndockPrivilege 1392 wmic.exe Token: SeManageVolumePrivilege 1392 wmic.exe Token: 33 1392 wmic.exe Token: 34 1392 wmic.exe Token: 35 1392 wmic.exe Token: SeIncreaseQuotaPrivilege 1392 wmic.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
f9dfdce85f83d7a416ecc162a9f68643357b1fd10ea29e6b2cd934b967192a74.bin.bin.exedescription pid Process procid_target PID 1700 wrote to memory of 888 1700 f9dfdce85f83d7a416ecc162a9f68643357b1fd10ea29e6b2cd934b967192a74.bin.bin.exe 29 PID 1700 wrote to memory of 888 1700 f9dfdce85f83d7a416ecc162a9f68643357b1fd10ea29e6b2cd934b967192a74.bin.bin.exe 29 PID 1700 wrote to memory of 888 1700 f9dfdce85f83d7a416ecc162a9f68643357b1fd10ea29e6b2cd934b967192a74.bin.bin.exe 29 PID 1700 wrote to memory of 888 1700 f9dfdce85f83d7a416ecc162a9f68643357b1fd10ea29e6b2cd934b967192a74.bin.bin.exe 29 PID 1700 wrote to memory of 1392 1700 f9dfdce85f83d7a416ecc162a9f68643357b1fd10ea29e6b2cd934b967192a74.bin.bin.exe 35 PID 1700 wrote to memory of 1392 1700 f9dfdce85f83d7a416ecc162a9f68643357b1fd10ea29e6b2cd934b967192a74.bin.bin.exe 35 PID 1700 wrote to memory of 1392 1700 f9dfdce85f83d7a416ecc162a9f68643357b1fd10ea29e6b2cd934b967192a74.bin.bin.exe 35 PID 1700 wrote to memory of 1392 1700 f9dfdce85f83d7a416ecc162a9f68643357b1fd10ea29e6b2cd934b967192a74.bin.bin.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9dfdce85f83d7a416ecc162a9f68643357b1fd10ea29e6b2cd934b967192a74.bin.bin.exe"C:\Users\Admin\AppData\Local\Temp\f9dfdce85f83d7a416ecc162a9f68643357b1fd10ea29e6b2cd934b967192a74.bin.bin.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\system32\wbem\wmic.exe"C:\ky\bqh\..\..\Windows\jik\..\system32\ve\..\wbem\ajn\aygp\..\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:888
-
-
C:\Windows\system32\wbem\wmic.exe"C:\hmi\c\..\..\Windows\vfoo\..\system32\ikapy\..\wbem\soug\ich\ylw\..\..\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1392
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1064
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵PID:1576
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5801⤵PID:1596