Analysis
-
max time kernel
87s -
max time network
89s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
19/12/2021, 01:40
Static task
static1
Behavioral task
behavioral1
Sample
TimeTime.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
TimeTime.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
TimeTime.exe
-
Size
19KB
-
MD5
8345d2b0dc8fd2134d12856557b15181
-
SHA1
a4c5ea013f8fc27d4079b5cd9f710bdbca02011f
-
SHA256
5ee8500fe1a2f22029908d4e2b32e7fb85aec03ffea714f3b5e82ebb2bc10f21
-
SHA512
bdfc9573df999957269f5bef22f7f20e75eae37765b9013f1971b4507d2f5420d591898aa4a535bc5158ab6367921dbf597378225aa02dd1a25f42b60624397e
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\.oracle_jre_usage\@[email protected]
Ransom Note
---------------Time Time Ransomware---------------
All of your document,pictures,videos are no longer accessible. We encrypted them !
We also stole your files,computer information,passwords,cookies.
If you don't pay us, we will leak everything on the dark web.
Please, find @[email protected] on your desktop to pay the ransom. If you don't find it,
check your recycle bin or antivirus quarantine.
We ask for 100€ of paysafecard (https://paysafecard.com)
/!\ Warning /!\
Please, do not rename encrypted files.
Do not use third party software.
Do not try to decrypt the files yourself.
/!\ Warning /!\
You got epicly pwned.
---------------Time Time Ransomware---------------
URLs
https://paysafecard.com
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 4 IoCs
pid Process 364 svchost.exe 2784 svchost.exe 2752 svchost.exe 1140 svchost.exe -
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ExportComplete.raw => C:\Users\Admin\Pictures\ExportComplete.raw.timetime TimeTime.exe File renamed C:\Users\Admin\Pictures\MountComplete.tif => C:\Users\Admin\Pictures\MountComplete.tif.timetime TimeTime.exe File renamed C:\Users\Admin\Pictures\UnblockConvert.crw => C:\Users\Admin\Pictures\UnblockConvert.crw.timetime TimeTime.exe File renamed C:\Users\Admin\Pictures\UseRedo.crw => C:\Users\Admin\Pictures\UseRedo.crw.timetime TimeTime.exe -
Drops desktop.ini file(s) 48 IoCs
description ioc Process File opened for modification C:\Users\Admin\Saved Games\desktop.ini TimeTime.exe File created C:\Users\Public\desktop.ini TimeTime.exe File opened for modification C:\Users\Public\Libraries\desktop.ini TimeTime.exe File created C:\Users\Public\Music\desktop.ini TimeTime.exe File opened for modification C:\Users\Public\Pictures\desktop.ini TimeTime.exe File opened for modification C:\Users\Public\Videos\desktop.ini TimeTime.exe File created C:\Users\Public\Videos\desktop.ini TimeTime.exe File created C:\Users\Admin\Contacts\desktop.ini TimeTime.exe File created C:\Users\Admin\OneDrive\desktop.ini TimeTime.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini TimeTime.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini TimeTime.exe File created C:\Users\Admin\Pictures\Saved Pictures\desktop.ini TimeTime.exe File created C:\Users\Admin\Searches\desktop.ini TimeTime.exe File created C:\Users\Public\Pictures\desktop.ini TimeTime.exe File created C:\Users\Admin\Favorites\Links\desktop.ini TimeTime.exe File opened for modification C:\Users\Admin\Links\desktop.ini TimeTime.exe File created C:\Users\Public\Documents\desktop.ini TimeTime.exe File created C:\Users\Admin\Desktop\desktop.ini TimeTime.exe File opened for modification C:\Users\Admin\Documents\desktop.ini TimeTime.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini TimeTime.exe File created C:\Users\Admin\Saved Games\desktop.ini TimeTime.exe File created C:\Users\Public\Desktop\desktop.ini TimeTime.exe File created C:\Users\Public\Libraries\desktop.ini TimeTime.exe File created C:\Users\Admin\Videos\desktop.ini TimeTime.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini TimeTime.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini TimeTime.exe File created C:\Users\Admin\Downloads\desktop.ini TimeTime.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini TimeTime.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini TimeTime.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini TimeTime.exe File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini TimeTime.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini TimeTime.exe File created C:\Users\Admin\Favorites\desktop.ini TimeTime.exe File created C:\Users\Admin\Links\desktop.ini TimeTime.exe File opened for modification C:\Users\Admin\Videos\desktop.ini TimeTime.exe File created C:\Users\Public\Downloads\desktop.ini TimeTime.exe File created C:\Users\Admin\Documents\desktop.ini TimeTime.exe File created C:\Users\Admin\Music\desktop.ini TimeTime.exe File created C:\Users\Admin\Pictures\desktop.ini TimeTime.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini TimeTime.exe File created C:\Users\Public\AccountPictures\desktop.ini TimeTime.exe File opened for modification C:\Users\Public\Documents\desktop.ini TimeTime.exe File opened for modification C:\Users\Admin\Music\desktop.ini TimeTime.exe File opened for modification C:\Users\Admin\Searches\desktop.ini TimeTime.exe File opened for modification C:\Users\Public\desktop.ini TimeTime.exe File opened for modification C:\Users\Public\Desktop\desktop.ini TimeTime.exe File opened for modification C:\Users\Public\Downloads\desktop.ini TimeTime.exe File opened for modification C:\Users\Public\Music\desktop.ini TimeTime.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\regedit.exe TimeTime.exe -
Drops file in Windows directory 24 IoCs
description ioc Process File opened for modification C:\Windows\setuperr.log TimeTime.exe File opened for modification C:\Windows\system.ini TimeTime.exe File opened for modification C:\Windows\win.ini TimeTime.exe File opened for modification C:\Windows\write.exe TimeTime.exe File opened for modification C:\Windows\bootstat.dat TimeTime.exe File opened for modification C:\Windows\PFRO.log TimeTime.exe File opened for modification C:\Windows\hh.exe TimeTime.exe File opened for modification C:\Windows\notepad.exe TimeTime.exe File opened for modification C:\Windows\WindowsShell.Manifest TimeTime.exe File opened for modification C:\Windows\WindowsUpdate.log TimeTime.exe File opened for modification C:\Windows\WMSysPr9.prx TimeTime.exe File created C:\Windows\bootstat.dat TimeTime.exe File opened for modification C:\Windows\DtcInstall.log TimeTime.exe File opened for modification C:\Windows\bfsvc.exe TimeTime.exe File opened for modification C:\Windows\mib.bin TimeTime.exe File opened for modification C:\Windows\HelpPane.exe TimeTime.exe File opened for modification C:\Windows\lsasetup.log TimeTime.exe File opened for modification C:\Windows\Professional.xml TimeTime.exe File opened for modification C:\Windows\setupact.log TimeTime.exe File opened for modification C:\Windows\splwow64.exe TimeTime.exe File opened for modification C:\Windows\twain_32.dll TimeTime.exe File created C:\Windows\@[email protected] TimeTime.exe File opened for modification C:\Windows\explorer.exe TimeTime.exe File opened for modification C:\Windows\winhlp32.exe TimeTime.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2616 vssadmin.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeBackupPrivilege 1696 vssvc.exe Token: SeRestorePrivilege 1696 vssvc.exe Token: SeAuditPrivilege 1696 vssvc.exe Token: SeIncreaseQuotaPrivilege 636 WMIC.exe Token: SeSecurityPrivilege 636 WMIC.exe Token: SeTakeOwnershipPrivilege 636 WMIC.exe Token: SeLoadDriverPrivilege 636 WMIC.exe Token: SeSystemProfilePrivilege 636 WMIC.exe Token: SeSystemtimePrivilege 636 WMIC.exe Token: SeProfSingleProcessPrivilege 636 WMIC.exe Token: SeIncBasePriorityPrivilege 636 WMIC.exe Token: SeCreatePagefilePrivilege 636 WMIC.exe Token: SeBackupPrivilege 636 WMIC.exe Token: SeRestorePrivilege 636 WMIC.exe Token: SeShutdownPrivilege 636 WMIC.exe Token: SeDebugPrivilege 636 WMIC.exe Token: SeSystemEnvironmentPrivilege 636 WMIC.exe Token: SeRemoteShutdownPrivilege 636 WMIC.exe Token: SeUndockPrivilege 636 WMIC.exe Token: SeManageVolumePrivilege 636 WMIC.exe Token: 33 636 WMIC.exe Token: 34 636 WMIC.exe Token: 35 636 WMIC.exe Token: 36 636 WMIC.exe Token: SeIncreaseQuotaPrivilege 636 WMIC.exe Token: SeSecurityPrivilege 636 WMIC.exe Token: SeTakeOwnershipPrivilege 636 WMIC.exe Token: SeLoadDriverPrivilege 636 WMIC.exe Token: SeSystemProfilePrivilege 636 WMIC.exe Token: SeSystemtimePrivilege 636 WMIC.exe Token: SeProfSingleProcessPrivilege 636 WMIC.exe Token: SeIncBasePriorityPrivilege 636 WMIC.exe Token: SeCreatePagefilePrivilege 636 WMIC.exe Token: SeBackupPrivilege 636 WMIC.exe Token: SeRestorePrivilege 636 WMIC.exe Token: SeShutdownPrivilege 636 WMIC.exe Token: SeDebugPrivilege 636 WMIC.exe Token: SeSystemEnvironmentPrivilege 636 WMIC.exe Token: SeRemoteShutdownPrivilege 636 WMIC.exe Token: SeUndockPrivilege 636 WMIC.exe Token: SeManageVolumePrivilege 636 WMIC.exe Token: 33 636 WMIC.exe Token: 34 636 WMIC.exe Token: 35 636 WMIC.exe Token: 36 636 WMIC.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 3608 wrote to memory of 2264 3608 TimeTime.exe 69 PID 3608 wrote to memory of 2264 3608 TimeTime.exe 69 PID 3608 wrote to memory of 2264 3608 TimeTime.exe 69 PID 2264 wrote to memory of 364 2264 TimeTime.exe 70 PID 2264 wrote to memory of 364 2264 TimeTime.exe 70 PID 2264 wrote to memory of 364 2264 TimeTime.exe 70 PID 364 wrote to memory of 2784 364 svchost.exe 71 PID 364 wrote to memory of 2784 364 svchost.exe 71 PID 364 wrote to memory of 2784 364 svchost.exe 71 PID 364 wrote to memory of 2752 364 svchost.exe 72 PID 364 wrote to memory of 2752 364 svchost.exe 72 PID 364 wrote to memory of 2752 364 svchost.exe 72 PID 364 wrote to memory of 1140 364 svchost.exe 73 PID 364 wrote to memory of 1140 364 svchost.exe 73 PID 364 wrote to memory of 1140 364 svchost.exe 73 PID 2784 wrote to memory of 2416 2784 svchost.exe 74 PID 2784 wrote to memory of 2416 2784 svchost.exe 74 PID 2784 wrote to memory of 2416 2784 svchost.exe 74 PID 2416 wrote to memory of 2616 2416 cmd.exe 76 PID 2416 wrote to memory of 2616 2416 cmd.exe 76 PID 2416 wrote to memory of 2616 2416 cmd.exe 76 PID 2416 wrote to memory of 636 2416 cmd.exe 78 PID 2416 wrote to memory of 636 2416 cmd.exe 78 PID 2416 wrote to memory of 636 2416 cmd.exe 78 PID 2784 wrote to memory of 3720 2784 svchost.exe 81 PID 2784 wrote to memory of 3720 2784 svchost.exe 81 PID 2784 wrote to memory of 3720 2784 svchost.exe 81 PID 2784 wrote to memory of 3116 2784 svchost.exe 83 PID 2784 wrote to memory of 3116 2784 svchost.exe 83 PID 2784 wrote to memory of 3116 2784 svchost.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\TimeTime.exe"C:\Users\Admin\AppData\Local\Temp\TimeTime.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\TimeTime.exe"C:\Users\Admin\AppData\Local\Temp\TimeTime.exe" /c2⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe" /x3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe" /x14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete5⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet6⤵
- Interacts with shadow copies
PID:2616
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete6⤵
- Suspicious use of AdjustPrivilegeToken
PID:636
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no5⤵PID:3720
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet5⤵PID:3116
-
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe" /x24⤵
- Executes dropped EXE
PID:2752
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe" /x34⤵
- Executes dropped EXE
PID:1140
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1696