Analysis
-
max time kernel
92s -
max time network
18s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
19/12/2021, 01:40
Static task
static1
Behavioral task
behavioral1
Sample
TimeTime.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
TimeTime.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
TimeTime.exe
-
Size
19KB
-
MD5
8345d2b0dc8fd2134d12856557b15181
-
SHA1
a4c5ea013f8fc27d4079b5cd9f710bdbca02011f
-
SHA256
5ee8500fe1a2f22029908d4e2b32e7fb85aec03ffea714f3b5e82ebb2bc10f21
-
SHA512
bdfc9573df999957269f5bef22f7f20e75eae37765b9013f1971b4507d2f5420d591898aa4a535bc5158ab6367921dbf597378225aa02dd1a25f42b60624397e
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\@[email protected]
Ransom Note
---------------Time Time Ransomware---------------
All of your document,pictures,videos are no longer accessible. We encrypted them !
We also stole your files,computer information,passwords,cookies.
If you don't pay us, we will leak everything on the dark web.
Please, find @[email protected] on your desktop to pay the ransom. If you don't find it,
check your recycle bin or antivirus quarantine.
We ask for 100€ of paysafecard (https://paysafecard.com)
/!\ Warning /!\
Please, do not rename encrypted files.
Do not use third party software.
Do not try to decrypt the files yourself.
/!\ Warning /!\
You got epicly pwned.
---------------Time Time Ransomware---------------
URLs
https://paysafecard.com
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 4 IoCs
pid Process 696 svchost.exe 836 svchost.exe 824 svchost.exe 1188 svchost.exe -
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\SaveClear.tif => C:\Users\Admin\Pictures\SaveClear.tif.timetime TimeTime.exe File renamed C:\Users\Admin\Pictures\SearchSync.tiff => C:\Users\Admin\Pictures\SearchSync.tiff.timetime TimeTime.exe File renamed C:\Users\Admin\Pictures\UnblockDeny.png => C:\Users\Admin\Pictures\UnblockDeny.png.timetime TimeTime.exe File opened for modification C:\Users\Admin\Pictures\SearchSync.tiff TimeTime.exe File renamed C:\Users\Admin\Pictures\SyncClear.crw => C:\Users\Admin\Pictures\SyncClear.crw.timetime TimeTime.exe File renamed C:\Users\Admin\Pictures\ConnectClose.tif => C:\Users\Admin\Pictures\ConnectClose.tif.timetime TimeTime.exe File opened for modification C:\Users\Admin\Pictures\InvokePush.tiff TimeTime.exe File renamed C:\Users\Admin\Pictures\InvokePush.tiff => C:\Users\Admin\Pictures\InvokePush.tiff.timetime TimeTime.exe File renamed C:\Users\Admin\Pictures\OutPublish.raw => C:\Users\Admin\Pictures\OutPublish.raw.timetime TimeTime.exe File renamed C:\Users\Admin\Pictures\RestoreStop.png => C:\Users\Admin\Pictures\RestoreStop.png.timetime TimeTime.exe -
Loads dropped DLL 4 IoCs
pid Process 516 TimeTime.exe 696 svchost.exe 696 svchost.exe 696 svchost.exe -
Drops desktop.ini file(s) 52 IoCs
description ioc Process File opened for modification C:\Users\Admin\Documents\desktop.ini TimeTime.exe File created C:\Users\Admin\Favorites\desktop.ini TimeTime.exe File opened for modification C:\Users\Public\Videos\desktop.ini TimeTime.exe File opened for modification C:\Users\Public\Documents\desktop.ini TimeTime.exe File created C:\Users\Public\Downloads\desktop.ini TimeTime.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini TimeTime.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini TimeTime.exe File created C:\Users\Admin\Documents\desktop.ini TimeTime.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini TimeTime.exe File opened for modification C:\Users\Admin\Links\desktop.ini TimeTime.exe File created C:\Users\Public\Desktop\desktop.ini TimeTime.exe File created C:\Users\Public\Documents\desktop.ini TimeTime.exe File opened for modification C:\Users\Public\Libraries\desktop.ini TimeTime.exe File opened for modification C:\Users\Public\Pictures\desktop.ini TimeTime.exe File created C:\Users\Public\Pictures\Sample Pictures\desktop.ini TimeTime.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini TimeTime.exe File created C:\Users\Admin\Favorites\Links\desktop.ini TimeTime.exe File created C:\Users\Admin\Saved Games\desktop.ini TimeTime.exe File opened for modification C:\Users\Admin\Videos\desktop.ini TimeTime.exe File created C:\Users\Public\Videos\Sample Videos\desktop.ini TimeTime.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini TimeTime.exe File created C:\Users\Admin\Downloads\desktop.ini TimeTime.exe File created C:\Users\Admin\Music\desktop.ini TimeTime.exe File created C:\Users\Public\Videos\desktop.ini TimeTime.exe File opened for modification C:\Users\Public\Music\desktop.ini TimeTime.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini TimeTime.exe File created C:\Users\Admin\Desktop\desktop.ini TimeTime.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini TimeTime.exe File created C:\Users\Admin\Pictures\desktop.ini TimeTime.exe File created C:\Users\Public\Recorded TV\Sample Media\desktop.ini TimeTime.exe File created C:\Users\Admin\Contacts\desktop.ini TimeTime.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini TimeTime.exe File created C:\Users\Admin\Links\desktop.ini TimeTime.exe File created C:\Users\Public\Libraries\desktop.ini TimeTime.exe File opened for modification C:\Users\Public\Downloads\desktop.ini TimeTime.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini TimeTime.exe File created C:\Users\Public\Music\Sample Music\desktop.ini TimeTime.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini TimeTime.exe File opened for modification C:\Users\Admin\Music\desktop.ini TimeTime.exe File opened for modification C:\Users\Admin\Searches\desktop.ini TimeTime.exe File created C:\Users\Admin\Searches\desktop.ini TimeTime.exe File created C:\Users\Admin\Videos\desktop.ini TimeTime.exe File created C:\Users\Public\Recorded TV\desktop.ini TimeTime.exe File created C:\Users\Public\desktop.ini TimeTime.exe File opened for modification C:\Users\Public\Desktop\desktop.ini TimeTime.exe File created C:\Users\Public\Music\desktop.ini TimeTime.exe File created C:\Users\Public\Pictures\desktop.ini TimeTime.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini TimeTime.exe File created C:\Users\Admin\Favorites\Links for United States\desktop.ini TimeTime.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini TimeTime.exe File opened for modification C:\Users\Public\desktop.ini TimeTime.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini TimeTime.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\regedit.exe TimeTime.exe -
Drops file in Windows directory 30 IoCs
description ioc Process File opened for modification C:\Windows\twunk_16.exe TimeTime.exe File opened for modification C:\Windows\setupact.log TimeTime.exe File opened for modification C:\Windows\DtcInstall.log TimeTime.exe File opened for modification C:\Windows\notepad.exe TimeTime.exe File created C:\Windows\bootstat.dat TimeTime.exe File opened for modification C:\Windows\setuperr.log TimeTime.exe File opened for modification C:\Windows\mib.bin TimeTime.exe File opened for modification C:\Windows\msdfmap.ini TimeTime.exe File opened for modification C:\Windows\PFRO.log TimeTime.exe File opened for modification C:\Windows\system.ini TimeTime.exe File opened for modification C:\Windows\TSSysprep.log TimeTime.exe File opened for modification C:\Windows\WindowsShell.Manifest TimeTime.exe File opened for modification C:\Windows\explorer.exe TimeTime.exe File opened for modification C:\Windows\fveupdate.exe TimeTime.exe File opened for modification C:\Windows\WMSysPr9.prx TimeTime.exe File created C:\Windows\@[email protected] TimeTime.exe File opened for modification C:\Windows\hh.exe TimeTime.exe File opened for modification C:\Windows\splwow64.exe TimeTime.exe File opened for modification C:\Windows\twain.dll TimeTime.exe File opened for modification C:\Windows\Ultimate.xml TimeTime.exe File opened for modification C:\Windows\write.exe TimeTime.exe File opened for modification C:\Windows\bfsvc.exe TimeTime.exe File opened for modification C:\Windows\HelpPane.exe TimeTime.exe File opened for modification C:\Windows\twain_32.dll TimeTime.exe File opened for modification C:\Windows\twunk_32.exe TimeTime.exe File opened for modification C:\Windows\win.ini TimeTime.exe File opened for modification C:\Windows\WindowsUpdate.log TimeTime.exe File opened for modification C:\Windows\winhlp32.exe TimeTime.exe File opened for modification C:\Windows\bootstat.dat TimeTime.exe File opened for modification C:\Windows\Starter.xml TimeTime.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1652 vssadmin.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeBackupPrivilege 1716 vssvc.exe Token: SeRestorePrivilege 1716 vssvc.exe Token: SeAuditPrivilege 1716 vssvc.exe Token: SeIncreaseQuotaPrivilege 1060 WMIC.exe Token: SeSecurityPrivilege 1060 WMIC.exe Token: SeTakeOwnershipPrivilege 1060 WMIC.exe Token: SeLoadDriverPrivilege 1060 WMIC.exe Token: SeSystemProfilePrivilege 1060 WMIC.exe Token: SeSystemtimePrivilege 1060 WMIC.exe Token: SeProfSingleProcessPrivilege 1060 WMIC.exe Token: SeIncBasePriorityPrivilege 1060 WMIC.exe Token: SeCreatePagefilePrivilege 1060 WMIC.exe Token: SeBackupPrivilege 1060 WMIC.exe Token: SeRestorePrivilege 1060 WMIC.exe Token: SeShutdownPrivilege 1060 WMIC.exe Token: SeDebugPrivilege 1060 WMIC.exe Token: SeSystemEnvironmentPrivilege 1060 WMIC.exe Token: SeRemoteShutdownPrivilege 1060 WMIC.exe Token: SeUndockPrivilege 1060 WMIC.exe Token: SeManageVolumePrivilege 1060 WMIC.exe Token: 33 1060 WMIC.exe Token: 34 1060 WMIC.exe Token: 35 1060 WMIC.exe Token: SeIncreaseQuotaPrivilege 1060 WMIC.exe Token: SeSecurityPrivilege 1060 WMIC.exe Token: SeTakeOwnershipPrivilege 1060 WMIC.exe Token: SeLoadDriverPrivilege 1060 WMIC.exe Token: SeSystemProfilePrivilege 1060 WMIC.exe Token: SeSystemtimePrivilege 1060 WMIC.exe Token: SeProfSingleProcessPrivilege 1060 WMIC.exe Token: SeIncBasePriorityPrivilege 1060 WMIC.exe Token: SeCreatePagefilePrivilege 1060 WMIC.exe Token: SeBackupPrivilege 1060 WMIC.exe Token: SeRestorePrivilege 1060 WMIC.exe Token: SeShutdownPrivilege 1060 WMIC.exe Token: SeDebugPrivilege 1060 WMIC.exe Token: SeSystemEnvironmentPrivilege 1060 WMIC.exe Token: SeRemoteShutdownPrivilege 1060 WMIC.exe Token: SeUndockPrivilege 1060 WMIC.exe Token: SeManageVolumePrivilege 1060 WMIC.exe Token: 33 1060 WMIC.exe Token: 34 1060 WMIC.exe Token: 35 1060 WMIC.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe 1724 TimeTime.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 1724 wrote to memory of 516 1724 TimeTime.exe 27 PID 1724 wrote to memory of 516 1724 TimeTime.exe 27 PID 1724 wrote to memory of 516 1724 TimeTime.exe 27 PID 1724 wrote to memory of 516 1724 TimeTime.exe 27 PID 516 wrote to memory of 696 516 TimeTime.exe 28 PID 516 wrote to memory of 696 516 TimeTime.exe 28 PID 516 wrote to memory of 696 516 TimeTime.exe 28 PID 516 wrote to memory of 696 516 TimeTime.exe 28 PID 696 wrote to memory of 836 696 svchost.exe 29 PID 696 wrote to memory of 836 696 svchost.exe 29 PID 696 wrote to memory of 836 696 svchost.exe 29 PID 696 wrote to memory of 836 696 svchost.exe 29 PID 696 wrote to memory of 824 696 svchost.exe 30 PID 696 wrote to memory of 824 696 svchost.exe 30 PID 696 wrote to memory of 824 696 svchost.exe 30 PID 696 wrote to memory of 824 696 svchost.exe 30 PID 696 wrote to memory of 1188 696 svchost.exe 31 PID 696 wrote to memory of 1188 696 svchost.exe 31 PID 696 wrote to memory of 1188 696 svchost.exe 31 PID 696 wrote to memory of 1188 696 svchost.exe 31 PID 836 wrote to memory of 1624 836 svchost.exe 32 PID 836 wrote to memory of 1624 836 svchost.exe 32 PID 836 wrote to memory of 1624 836 svchost.exe 32 PID 836 wrote to memory of 1624 836 svchost.exe 32 PID 1624 wrote to memory of 1652 1624 cmd.exe 34 PID 1624 wrote to memory of 1652 1624 cmd.exe 34 PID 1624 wrote to memory of 1652 1624 cmd.exe 34 PID 1624 wrote to memory of 1652 1624 cmd.exe 34 PID 1624 wrote to memory of 1060 1624 cmd.exe 36 PID 1624 wrote to memory of 1060 1624 cmd.exe 36 PID 1624 wrote to memory of 1060 1624 cmd.exe 36 PID 1624 wrote to memory of 1060 1624 cmd.exe 36 PID 836 wrote to memory of 1248 836 svchost.exe 39 PID 836 wrote to memory of 1248 836 svchost.exe 39 PID 836 wrote to memory of 1248 836 svchost.exe 39 PID 836 wrote to memory of 1248 836 svchost.exe 39 PID 836 wrote to memory of 304 836 svchost.exe 41 PID 836 wrote to memory of 304 836 svchost.exe 41 PID 836 wrote to memory of 304 836 svchost.exe 41 PID 836 wrote to memory of 304 836 svchost.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\TimeTime.exe"C:\Users\Admin\AppData\Local\Temp\TimeTime.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\TimeTime.exe"C:\Users\Admin\AppData\Local\Temp\TimeTime.exe" /c2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe" /x3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe" /x14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete5⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet6⤵
- Interacts with shadow copies
PID:1652
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete6⤵
- Suspicious use of AdjustPrivilegeToken
PID:1060
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no5⤵PID:1248
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet5⤵PID:304
-
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe" /x24⤵
- Executes dropped EXE
PID:824
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe" /x34⤵
- Executes dropped EXE
PID:1188
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1716
-
C:\Windows\system32\NOTEPAD.EXEPID:428