Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
15-10-2021 19:54
Behavioral task
behavioral1
Sample
ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe
Resource
win10-en-20211014
General
-
Target
ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe
-
Size
1.8MB
-
MD5
7d4550dd4c6996057147ecc996b14e9a
-
SHA1
d0d68281f8459b5558559fbbf8c6c8ab4ddfec8b
-
SHA256
ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d
-
SHA512
e0653ac9c92bd134ff43886b4a8a36016660294c134ff11c6cddefe50494923fdcf370c3d96d5538d2c7ef20d216b4d15b914d40002c982c69021ee8998f57df
Malware Config
Extracted
C:\HOW-TO-DECRYPT-gn9cj.txt
Signatures
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\AllTable\Script cryptone C:\Users\Admin\AppData\Roaming\AllTable\Script cryptone -
Executes dropped EXE 1 IoCs
Processes:
Scriptpid process 3304 Script -
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
Scriptdescription ioc process File renamed C:\Users\Admin\Pictures\CompleteLimit.tiff => C:\Users\Admin\Pictures\CompleteLimit.tiff.gn9cj Script File opened for modification C:\Users\Admin\Pictures\CompleteLimit.tiff.gn9cj Script File renamed C:\Users\Admin\Pictures\EnterGrant.png => C:\Users\Admin\Pictures\EnterGrant.png.gn9cj Script File opened for modification C:\Users\Admin\Pictures\EnterGrant.png.gn9cj Script -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exeScriptcmd.execmd.exedescription pid process target process PID 2680 wrote to memory of 3304 2680 ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe Script PID 2680 wrote to memory of 3304 2680 ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe Script PID 3304 wrote to memory of 2064 3304 Script cmd.exe PID 3304 wrote to memory of 2064 3304 Script cmd.exe PID 2680 wrote to memory of 2368 2680 ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe cmd.exe PID 2680 wrote to memory of 2368 2680 ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe cmd.exe PID 2368 wrote to memory of 400 2368 cmd.exe waitfor.exe PID 2368 wrote to memory of 400 2368 cmd.exe waitfor.exe PID 2064 wrote to memory of 1380 2064 cmd.exe waitfor.exe PID 2064 wrote to memory of 1380 2064 cmd.exe waitfor.exe PID 2064 wrote to memory of 1156 2064 cmd.exe attrib.exe PID 2064 wrote to memory of 1156 2064 cmd.exe attrib.exe PID 2368 wrote to memory of 1224 2368 cmd.exe attrib.exe PID 2368 wrote to memory of 1224 2368 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1156 attrib.exe 1224 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe"C:\Users\Admin\AppData\Local\Temp\ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AllTable\ScriptC:\Users\Admin\AppData\Roaming\AllTable\Script /go2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c waitfor /t 10 pause /d y & attrib -h "C:\Users\Admin\AppData\Roaming\AllTable\Script" & del "C:\Users\Admin\AppData\Roaming\AllTable\Script" & rd "C:\Users\Admin\AppData\Roaming\AllTable\"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\waitfor.exewaitfor /t 10 pause /d y4⤵
-
C:\Windows\system32\attrib.exeattrib -h "C:\Users\Admin\AppData\Roaming\AllTable\Script"4⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\cmd.execmd /c waitfor /t 10 pause /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe" & del "C:\Users\Admin\AppData\Local\Temp\ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe" & rd "C:\Users\Admin\AppData\Local\Temp\"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\waitfor.exewaitfor /t 10 pause /d y3⤵
-
C:\Windows\system32\attrib.exeattrib -h "C:\Users\Admin\AppData\Local\Temp\ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d.bin.exe"3⤵
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\AllTable\ScriptMD5
7d4550dd4c6996057147ecc996b14e9a
SHA1d0d68281f8459b5558559fbbf8c6c8ab4ddfec8b
SHA256ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d
SHA512e0653ac9c92bd134ff43886b4a8a36016660294c134ff11c6cddefe50494923fdcf370c3d96d5538d2c7ef20d216b4d15b914d40002c982c69021ee8998f57df
-
C:\Users\Admin\AppData\Roaming\AllTable\ScriptMD5
7d4550dd4c6996057147ecc996b14e9a
SHA1d0d68281f8459b5558559fbbf8c6c8ab4ddfec8b
SHA256ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d
SHA512e0653ac9c92bd134ff43886b4a8a36016660294c134ff11c6cddefe50494923fdcf370c3d96d5538d2c7ef20d216b4d15b914d40002c982c69021ee8998f57df
-
memory/400-127-0x0000000000000000-mapping.dmp
-
memory/1156-129-0x0000000000000000-mapping.dmp
-
memory/1224-130-0x0000000000000000-mapping.dmp
-
memory/1380-128-0x0000000000000000-mapping.dmp
-
memory/2064-125-0x0000000000000000-mapping.dmp
-
memory/2368-126-0x0000000000000000-mapping.dmp
-
memory/2680-115-0x0000000140000000-0x00000001401D8000-memory.dmpFilesize
1.8MB
-
memory/2680-118-0x0000000002010000-0x00000000021D2000-memory.dmpFilesize
1.8MB
-
memory/3304-119-0x0000000000000000-mapping.dmp
-
memory/3304-122-0x0000000140000000-0x00000001401D8000-memory.dmpFilesize
1.8MB