Analysis
-
max time kernel
135s -
max time network
164s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
18-09-2021 11:33
Static task
static1
Behavioral task
behavioral1
Sample
TimeCrypt.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
TimeCrypt.exe
Resource
win10-en
General
-
Target
TimeCrypt.exe
-
Size
591KB
-
MD5
22ff13395d2dbf841909c4f348dfd6c1
-
SHA1
5b90b19882166214a64c9af5a2a28a5f5a1a0d6f
-
SHA256
d1d1f2984d23b53c022e454b0736b65375926d73c7db299f4a931c974ad9a8b4
-
SHA512
be44092b58096d6c2c95232523c110f1b441e1a1411b3212fb1f793cddbc01d960b7a7018772d96c608117d67d435e6143dae7587d003bbfef6328b5daf66f3d
Malware Config
Signatures
-
Drops startup file 2 IoCs
Processes:
TimeCrypt.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TimeCrypt.exe TimeCrypt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kcry-info.txt TimeCrypt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
TimeCrypt.exedescription pid process Token: SeDebugPrivilege 1940 TimeCrypt.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
notepad.exepid process 624 notepad.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
TimeCrypt.execmd.exedescription pid process target process PID 1940 wrote to memory of 1772 1940 TimeCrypt.exe cmd.exe PID 1940 wrote to memory of 1772 1940 TimeCrypt.exe cmd.exe PID 1940 wrote to memory of 1772 1940 TimeCrypt.exe cmd.exe PID 1940 wrote to memory of 1772 1940 TimeCrypt.exe cmd.exe PID 1772 wrote to memory of 624 1772 cmd.exe notepad.exe PID 1772 wrote to memory of 624 1772 cmd.exe notepad.exe PID 1772 wrote to memory of 624 1772 cmd.exe notepad.exe PID 1772 wrote to memory of 624 1772 cmd.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TimeCrypt.exe"C:\Users\Admin\AppData\Local\Temp\TimeCrypt.exe"1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C start notepad.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kcry-info.txt2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kcry-info.txt3⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kcry-info.txtMD5
bc12f7cb291d0bd04e8e2cb29d5fcdba
SHA1a655f290d16ac7024e064bf09a2ec9761d57bff8
SHA2563e9fefe58edc3d34e9107af4f1203c6ad52f26b0b9588adc3a3112bf3410f130
SHA512c03b9c6597ad1a7f3ec42a7a84d71536536e65d2f4a3ccbd87980fd827a23edbff14485de70205b6086a5a4d03a5c77a5248688a0a49c99a1a4f80c7074e2ece
-
memory/624-66-0x0000000000000000-mapping.dmp
-
memory/624-67-0x0000000076691000-0x0000000076693000-memory.dmpFilesize
8KB
-
memory/1760-69-0x000007FEFBFB1000-0x000007FEFBFB3000-memory.dmpFilesize
8KB
-
memory/1772-65-0x0000000000000000-mapping.dmp
-
memory/1940-60-0x0000000000910000-0x0000000000911000-memory.dmpFilesize
4KB
-
memory/1940-62-0x00000000049F0000-0x00000000049F1000-memory.dmpFilesize
4KB
-
memory/1940-63-0x00000000049F5000-0x0000000004A06000-memory.dmpFilesize
68KB
-
memory/1940-64-0x0000000007DD0000-0x0000000007E41000-memory.dmpFilesize
452KB