Analysis
-
max time kernel
359s -
max time network
359s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
13-10-2021 12:07
Static task
static1
Behavioral task
behavioral1
Sample
trabajo escuela.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
trabajo escuela.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
-
Target
trabajo escuela.exe
-
Size
614KB
-
MD5
535994874b99eea69b30569bc7176440
-
SHA1
e10245fd72b3ff5f219b18fb292fb3b33ae3a3e5
-
SHA256
79c0f9223e6861b8bf5f6f3ef860bc517e8fcb544efee34bb5f2cc9867af75a7
-
SHA512
12bb6e3737f545ecbef371e079d6764d8e35ff8f940258b430f16e07d34e214c030f6ce0518461639178209fe2da62941a1de763fc25490c0e02e8e064da596f
Score
9/10
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 1436 bcdedit.exe 612 bcdedit.exe -
pid Process 756 wbadmin.exe -
Executes dropped EXE 2 IoCs
pid Process 1836 CRYpt0r V3.0.exe 1380 svchost.exe -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LEER IMPORTANTE.txt svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 33 IoCs
description ioc Process File opened for modification C:\Users\Public\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Searches\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\Music\desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini svchost.exe File opened for modification C:\Users\Public\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini svchost.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\20vcyeq36.jpg" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1832 vssadmin.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1380 svchost.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1836 CRYpt0r V3.0.exe 1836 CRYpt0r V3.0.exe 1380 svchost.exe 1380 svchost.exe 1380 svchost.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 1836 CRYpt0r V3.0.exe Token: SeDebugPrivilege 1380 svchost.exe Token: SeBackupPrivilege 1352 vssvc.exe Token: SeRestorePrivilege 1352 vssvc.exe Token: SeAuditPrivilege 1352 vssvc.exe Token: SeIncreaseQuotaPrivilege 764 WMIC.exe Token: SeSecurityPrivilege 764 WMIC.exe Token: SeTakeOwnershipPrivilege 764 WMIC.exe Token: SeLoadDriverPrivilege 764 WMIC.exe Token: SeSystemProfilePrivilege 764 WMIC.exe Token: SeSystemtimePrivilege 764 WMIC.exe Token: SeProfSingleProcessPrivilege 764 WMIC.exe Token: SeIncBasePriorityPrivilege 764 WMIC.exe Token: SeCreatePagefilePrivilege 764 WMIC.exe Token: SeBackupPrivilege 764 WMIC.exe Token: SeRestorePrivilege 764 WMIC.exe Token: SeShutdownPrivilege 764 WMIC.exe Token: SeDebugPrivilege 764 WMIC.exe Token: SeSystemEnvironmentPrivilege 764 WMIC.exe Token: SeRemoteShutdownPrivilege 764 WMIC.exe Token: SeUndockPrivilege 764 WMIC.exe Token: SeManageVolumePrivilege 764 WMIC.exe Token: 33 764 WMIC.exe Token: 34 764 WMIC.exe Token: 35 764 WMIC.exe Token: SeIncreaseQuotaPrivilege 764 WMIC.exe Token: SeSecurityPrivilege 764 WMIC.exe Token: SeTakeOwnershipPrivilege 764 WMIC.exe Token: SeLoadDriverPrivilege 764 WMIC.exe Token: SeSystemProfilePrivilege 764 WMIC.exe Token: SeSystemtimePrivilege 764 WMIC.exe Token: SeProfSingleProcessPrivilege 764 WMIC.exe Token: SeIncBasePriorityPrivilege 764 WMIC.exe Token: SeCreatePagefilePrivilege 764 WMIC.exe Token: SeBackupPrivilege 764 WMIC.exe Token: SeRestorePrivilege 764 WMIC.exe Token: SeShutdownPrivilege 764 WMIC.exe Token: SeDebugPrivilege 764 WMIC.exe Token: SeSystemEnvironmentPrivilege 764 WMIC.exe Token: SeRemoteShutdownPrivilege 764 WMIC.exe Token: SeUndockPrivilege 764 WMIC.exe Token: SeManageVolumePrivilege 764 WMIC.exe Token: 33 764 WMIC.exe Token: 34 764 WMIC.exe Token: 35 764 WMIC.exe Token: SeBackupPrivilege 1188 wbengine.exe Token: SeRestorePrivilege 1188 wbengine.exe Token: SeSecurityPrivilege 1188 wbengine.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 1540 wrote to memory of 1836 1540 trabajo escuela.exe 27 PID 1540 wrote to memory of 1836 1540 trabajo escuela.exe 27 PID 1540 wrote to memory of 1836 1540 trabajo escuela.exe 27 PID 1836 wrote to memory of 1380 1836 CRYpt0r V3.0.exe 28 PID 1836 wrote to memory of 1380 1836 CRYpt0r V3.0.exe 28 PID 1836 wrote to memory of 1380 1836 CRYpt0r V3.0.exe 28 PID 1380 wrote to memory of 1632 1380 svchost.exe 30 PID 1380 wrote to memory of 1632 1380 svchost.exe 30 PID 1380 wrote to memory of 1632 1380 svchost.exe 30 PID 1632 wrote to memory of 1832 1632 cmd.exe 32 PID 1632 wrote to memory of 1832 1632 cmd.exe 32 PID 1632 wrote to memory of 1832 1632 cmd.exe 32 PID 1632 wrote to memory of 764 1632 cmd.exe 36 PID 1632 wrote to memory of 764 1632 cmd.exe 36 PID 1632 wrote to memory of 764 1632 cmd.exe 36 PID 1380 wrote to memory of 1972 1380 svchost.exe 38 PID 1380 wrote to memory of 1972 1380 svchost.exe 38 PID 1380 wrote to memory of 1972 1380 svchost.exe 38 PID 1972 wrote to memory of 1436 1972 cmd.exe 40 PID 1972 wrote to memory of 1436 1972 cmd.exe 40 PID 1972 wrote to memory of 1436 1972 cmd.exe 40 PID 1972 wrote to memory of 612 1972 cmd.exe 41 PID 1972 wrote to memory of 612 1972 cmd.exe 41 PID 1972 wrote to memory of 612 1972 cmd.exe 41 PID 1380 wrote to memory of 1824 1380 svchost.exe 42 PID 1380 wrote to memory of 1824 1380 svchost.exe 42 PID 1380 wrote to memory of 1824 1380 svchost.exe 42 PID 1824 wrote to memory of 756 1824 cmd.exe 44 PID 1824 wrote to memory of 756 1824 cmd.exe 44 PID 1824 wrote to memory of 756 1824 cmd.exe 44 PID 1380 wrote to memory of 1540 1380 svchost.exe 48 PID 1380 wrote to memory of 1540 1380 svchost.exe 48 PID 1380 wrote to memory of 1540 1380 svchost.exe 48
Processes
-
C:\Users\Admin\AppData\Local\Temp\trabajo escuela.exe"C:\Users\Admin\AppData\Local\Temp\trabajo escuela.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\CRYpt0r V3.0.exe"C:\Users\Admin\AppData\Local\Temp\CRYpt0r V3.0.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete4⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Interacts with shadow copies
PID:1832
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
PID:764
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no4⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures5⤵
- Modifies boot configuration data using bcdedit
PID:1436
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no5⤵
- Modifies boot configuration data using bcdedit
PID:612
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet4⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet5⤵
- Deletes backup catalog
PID:756
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\LEER IMPORTANTE.txt4⤵PID:1540
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1352
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1188
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:832
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1728