Analysis
-
max time kernel
124s -
max time network
126s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
15-10-2021 19:14
Behavioral task
behavioral1
Sample
d35c8035a81539f841afcbc400ba73c66290f97b07881fbb590ea67a82990baa.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
d35c8035a81539f841afcbc400ba73c66290f97b07881fbb590ea67a82990baa.exe
Resource
win10-en-20211014
General
-
Target
d35c8035a81539f841afcbc400ba73c66290f97b07881fbb590ea67a82990baa.exe
-
Size
1.8MB
-
MD5
afe1317423c7fea2eadb520f15fd1244
-
SHA1
f66af8f2ac9206b87a4388f59c69ae092502fb7b
-
SHA256
d35c8035a81539f841afcbc400ba73c66290f97b07881fbb590ea67a82990baa
-
SHA512
909c2d66091da3f70e225e95ab24497a565cf1f45cb60e4ec511b0b9885456cb15bee8602eee49318f066b851aeddc8e6fff4f36e42a42d1754fd153eb1bd066
Malware Config
Extracted
C:\HOW-TO-DECRYPT-gn9cj.txt
Signatures
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\AllTable\Script cryptone C:\Users\Admin\AppData\Roaming\AllTable\Script cryptone -
Executes dropped EXE 1 IoCs
Processes:
Scriptpid process 816 Script -
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
Scriptdescription ioc process File opened for modification C:\Users\Admin\Pictures\DenyBackup.tif.gn9cj Script File renamed C:\Users\Admin\Pictures\EnableBackup.png => C:\Users\Admin\Pictures\EnableBackup.png.gn9cj Script File opened for modification C:\Users\Admin\Pictures\EnableBackup.png.gn9cj Script File opened for modification C:\Users\Admin\Pictures\RestoreBlock.tiff.gn9cj Script File renamed C:\Users\Admin\Pictures\ConvertToSelect.tiff => C:\Users\Admin\Pictures\ConvertToSelect.tiff.gn9cj Script File renamed C:\Users\Admin\Pictures\DenyBackup.tif => C:\Users\Admin\Pictures\DenyBackup.tif.gn9cj Script File opened for modification C:\Users\Admin\Pictures\ConvertToSelect.tiff.gn9cj Script File renamed C:\Users\Admin\Pictures\RestoreBlock.tiff => C:\Users\Admin\Pictures\RestoreBlock.tiff.gn9cj Script File renamed C:\Users\Admin\Pictures\ClearDisconnect.tiff => C:\Users\Admin\Pictures\ClearDisconnect.tiff.gn9cj Script File opened for modification C:\Users\Admin\Pictures\ClearDisconnect.tiff.gn9cj Script -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
d35c8035a81539f841afcbc400ba73c66290f97b07881fbb590ea67a82990baa.exeScriptcmd.execmd.exedescription pid process target process PID 1768 wrote to memory of 816 1768 d35c8035a81539f841afcbc400ba73c66290f97b07881fbb590ea67a82990baa.exe Script PID 1768 wrote to memory of 816 1768 d35c8035a81539f841afcbc400ba73c66290f97b07881fbb590ea67a82990baa.exe Script PID 816 wrote to memory of 808 816 Script cmd.exe PID 816 wrote to memory of 808 816 Script cmd.exe PID 1768 wrote to memory of 3732 1768 d35c8035a81539f841afcbc400ba73c66290f97b07881fbb590ea67a82990baa.exe cmd.exe PID 1768 wrote to memory of 3732 1768 d35c8035a81539f841afcbc400ba73c66290f97b07881fbb590ea67a82990baa.exe cmd.exe PID 808 wrote to memory of 1832 808 cmd.exe waitfor.exe PID 808 wrote to memory of 1832 808 cmd.exe waitfor.exe PID 3732 wrote to memory of 516 3732 cmd.exe waitfor.exe PID 3732 wrote to memory of 516 3732 cmd.exe waitfor.exe PID 3732 wrote to memory of 1476 3732 cmd.exe attrib.exe PID 3732 wrote to memory of 1476 3732 cmd.exe attrib.exe PID 808 wrote to memory of 1404 808 cmd.exe attrib.exe PID 808 wrote to memory of 1404 808 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1404 attrib.exe 1476 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d35c8035a81539f841afcbc400ba73c66290f97b07881fbb590ea67a82990baa.exe"C:\Users\Admin\AppData\Local\Temp\d35c8035a81539f841afcbc400ba73c66290f97b07881fbb590ea67a82990baa.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AllTable\ScriptC:\Users\Admin\AppData\Roaming\AllTable\Script /go2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c waitfor /t 10 pause /d y & attrib -h "C:\Users\Admin\AppData\Roaming\AllTable\Script" & del "C:\Users\Admin\AppData\Roaming\AllTable\Script" & rd "C:\Users\Admin\AppData\Roaming\AllTable\"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\waitfor.exewaitfor /t 10 pause /d y4⤵
-
C:\Windows\system32\attrib.exeattrib -h "C:\Users\Admin\AppData\Roaming\AllTable\Script"4⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\cmd.execmd /c waitfor /t 10 pause /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\d35c8035a81539f841afcbc400ba73c66290f97b07881fbb590ea67a82990baa.exe" & del "C:\Users\Admin\AppData\Local\Temp\d35c8035a81539f841afcbc400ba73c66290f97b07881fbb590ea67a82990baa.exe" & rd "C:\Users\Admin\AppData\Local\Temp\"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\waitfor.exewaitfor /t 10 pause /d y3⤵
-
C:\Windows\system32\attrib.exeattrib -h "C:\Users\Admin\AppData\Local\Temp\d35c8035a81539f841afcbc400ba73c66290f97b07881fbb590ea67a82990baa.exe"3⤵
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\AllTable\ScriptMD5
afe1317423c7fea2eadb520f15fd1244
SHA1f66af8f2ac9206b87a4388f59c69ae092502fb7b
SHA256d35c8035a81539f841afcbc400ba73c66290f97b07881fbb590ea67a82990baa
SHA512909c2d66091da3f70e225e95ab24497a565cf1f45cb60e4ec511b0b9885456cb15bee8602eee49318f066b851aeddc8e6fff4f36e42a42d1754fd153eb1bd066
-
C:\Users\Admin\AppData\Roaming\AllTable\ScriptMD5
afe1317423c7fea2eadb520f15fd1244
SHA1f66af8f2ac9206b87a4388f59c69ae092502fb7b
SHA256d35c8035a81539f841afcbc400ba73c66290f97b07881fbb590ea67a82990baa
SHA512909c2d66091da3f70e225e95ab24497a565cf1f45cb60e4ec511b0b9885456cb15bee8602eee49318f066b851aeddc8e6fff4f36e42a42d1754fd153eb1bd066
-
memory/516-128-0x0000000000000000-mapping.dmp
-
memory/808-125-0x0000000000000000-mapping.dmp
-
memory/816-118-0x0000000000000000-mapping.dmp
-
memory/816-122-0x0000000140000000-0x00000001401D8000-memory.dmpFilesize
1.8MB
-
memory/1404-130-0x0000000000000000-mapping.dmp
-
memory/1476-129-0x0000000000000000-mapping.dmp
-
memory/1768-115-0x0000000140000000-0x00000001401D8000-memory.dmpFilesize
1.8MB
-
memory/1768-121-0x0000000002160000-0x0000000002322000-memory.dmpFilesize
1.8MB
-
memory/1832-127-0x0000000000000000-mapping.dmp
-
memory/3732-126-0x0000000000000000-mapping.dmp