Analysis
-
max time kernel
200s -
max time network
161s -
platform
windows10_x64 -
resource
win10-en -
submitted
18-09-2021 11:33
Static task
static1
Behavioral task
behavioral1
Sample
TimeCrypt.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
TimeCrypt.exe
Resource
win10-en
General
-
Target
TimeCrypt.exe
-
Size
591KB
-
MD5
22ff13395d2dbf841909c4f348dfd6c1
-
SHA1
5b90b19882166214a64c9af5a2a28a5f5a1a0d6f
-
SHA256
d1d1f2984d23b53c022e454b0736b65375926d73c7db299f4a931c974ad9a8b4
-
SHA512
be44092b58096d6c2c95232523c110f1b441e1a1411b3212fb1f793cddbc01d960b7a7018772d96c608117d67d435e6143dae7587d003bbfef6328b5daf66f3d
Malware Config
Signatures
-
Drops startup file 2 IoCs
Processes:
TimeCrypt.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kcry-info.txt TimeCrypt.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TimeCrypt.exe TimeCrypt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
TimeCrypt.exedescription pid process Token: SeDebugPrivilege 4736 TimeCrypt.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
notepad.exepid process 5052 notepad.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
TimeCrypt.execmd.exedescription pid process target process PID 4736 wrote to memory of 5000 4736 TimeCrypt.exe cmd.exe PID 4736 wrote to memory of 5000 4736 TimeCrypt.exe cmd.exe PID 4736 wrote to memory of 5000 4736 TimeCrypt.exe cmd.exe PID 5000 wrote to memory of 5052 5000 cmd.exe notepad.exe PID 5000 wrote to memory of 5052 5000 cmd.exe notepad.exe PID 5000 wrote to memory of 5052 5000 cmd.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TimeCrypt.exe"C:\Users\Admin\AppData\Local\Temp\TimeCrypt.exe"1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C start notepad.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kcry-info.txt2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kcry-info.txt3⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kcry-info.txtMD5
bc12f7cb291d0bd04e8e2cb29d5fcdba
SHA1a655f290d16ac7024e064bf09a2ec9761d57bff8
SHA2563e9fefe58edc3d34e9107af4f1203c6ad52f26b0b9588adc3a3112bf3410f130
SHA512c03b9c6597ad1a7f3ec42a7a84d71536536e65d2f4a3ccbd87980fd827a23edbff14485de70205b6086a5a4d03a5c77a5248688a0a49c99a1a4f80c7074e2ece
-
memory/4736-115-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/4736-117-0x0000000005150000-0x0000000005151000-memory.dmpFilesize
4KB
-
memory/4736-118-0x0000000004AF0000-0x0000000004AF1000-memory.dmpFilesize
4KB
-
memory/4736-119-0x0000000004A80000-0x0000000004A81000-memory.dmpFilesize
4KB
-
memory/4736-120-0x0000000004C40000-0x0000000004C41000-memory.dmpFilesize
4KB
-
memory/4736-121-0x0000000004C43000-0x0000000004C45000-memory.dmpFilesize
8KB
-
memory/4736-122-0x000000000A070000-0x000000000A0E1000-memory.dmpFilesize
452KB
-
memory/5000-123-0x0000000000000000-mapping.dmp
-
memory/5052-124-0x0000000000000000-mapping.dmp