Analysis
- max time kernel
122s - max time network
128s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
05/01/2022, 06:23
Static task
static1
Behavioral task
behavioral1
Sample
972e65bc88e89bd5ce6bada6ba84bf9b5fb64d1b742e2b1ebf95c4926b8f2b3e.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
972e65bc88e89bd5ce6bada6ba84bf9b5fb64d1b742e2b1ebf95c4926b8f2b3e.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target 972e65bc88e89bd5ce6bada6ba84bf9b5fb64d1b742e2b1ebf95c4926b8f2b3e.exe
- Size 19KB
- Sample220105-g5gfeaachk
- SHA256 972e65bc88e89bd5ce6bada6ba84bf9b5fb64d1b742e2b1ebf95c4926b8f2b3e
- MD5 861a2d95cf43c1489f1fdb95301d5190
- SHA1 9286e26e0ba3210a6fdb139b0fb9846d6a3c64dd
- SHA512 bcd3ebffeb809773f09c44dc049dafc63a6a312bff380266a54cc9bffb8c2e7b888f164b1d8c24cccfb34d5a22f2751e2c12f0fddcd1705cedd4b05eb49a099b
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\@[email protected]
Ransom Note
- ---------------Time Time Ransomware--------------- All of your document,pictures,videos are no longer accessible. We encrypted them ! We also stole your files,computer information,passwords,cookies. If you don't pay us, we will leak everything on the dark web. Please, find @[email protected] on your desktop to pay the ransom. If you don't find it, check your recycle bin or antivirus quarantine. We ask for 100€ of paysafecard (https://paysafecard.com) /!\ Warning /!\ Please, do not rename encrypted files. Do not use third party software. Do not try to decrypt the files yourself. /!\ Warning /!\ You got epicly pwned. ---------------Time Time Ransomware---------------
URLs
-
https://paysafecard.com
Signatures
- Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Executes dropped EXE 3 IoCs
pid Process 1064 lsass.exe 1492 lsass.exe 1684 svchost.exe - Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\RestoreCompare.raw => C:\Users\Admin\Pictures\RestoreCompare.raw.timetime lsass.exe File renamed C:\Users\Admin\Pictures\SearchConnect.png => C:\Users\Admin\Pictures\SearchConnect.png.timetime lsass.exe File renamed C:\Users\Admin\Pictures\SelectWrite.tiff => C:\Users\Admin\Pictures\SelectWrite.tiff.timetime lsass.exe File renamed C:\Users\Admin\Pictures\InstallConvertTo.png => C:\Users\Admin\Pictures\InstallConvertTo.png.timetime lsass.exe File opened for modification C:\Users\Admin\Pictures\NewUnblock.tiff lsass.exe File renamed C:\Users\Admin\Pictures\NewUnblock.tiff => C:\Users\Admin\Pictures\NewUnblock.tiff.timetime lsass.exe File renamed C:\Users\Admin\Pictures\RedoLimit.tif => C:\Users\Admin\Pictures\RedoLimit.tif.timetime lsass.exe File renamed C:\Users\Admin\Pictures\ClearSave.tif => C:\Users\Admin\Pictures\ClearSave.tif.timetime lsass.exe File opened for modification C:\Users\Admin\Pictures\SelectWrite.tiff lsass.exe - Loads dropped DLL 3 IoCs
pid Process 1620 972e65bc88e89bd5ce6bada6ba84bf9b5fb64d1b742e2b1ebf95c4926b8f2b3e.exe 1064 lsass.exe 1492 lsass.exe - Drops desktop.ini file(s) 52 IoCs
description ioc Process File opened for modification C:\Users\Admin\Desktop\desktop.ini lsass.exe File opened for modification C:\Users\Admin\Links\desktop.ini lsass.exe File created C:\Users\Public\Music\Sample Music\desktop.ini lsass.exe File opened for modification C:\Users\Public\Pictures\desktop.ini lsass.exe File created C:\Users\Public\Pictures\desktop.ini lsass.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini lsass.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini lsass.exe File created C:\Users\Admin\Favorites\Links\desktop.ini lsass.exe File created C:\Users\Public\desktop.ini lsass.exe File created C:\Users\Public\Desktop\desktop.ini lsass.exe File opened for modification C:\Users\Public\Downloads\desktop.ini lsass.exe File opened for modification C:\Users\Public\Libraries\desktop.ini lsass.exe File opened for modification C:\Users\Public\Videos\desktop.ini lsass.exe File created C:\Users\Admin\Desktop\desktop.ini lsass.exe File created C:\Users\Admin\Favorites\Links for United States\desktop.ini lsass.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini lsass.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini lsass.exe File created C:\Users\Public\Recorded TV\desktop.ini lsass.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini lsass.exe File created C:\Users\Public\Recorded TV\Sample Media\desktop.ini lsass.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini lsass.exe File created C:\Users\Admin\Favorites\desktop.ini lsass.exe File created C:\Users\Admin\Saved Games\desktop.ini lsass.exe File opened for modification C:\Users\Admin\Videos\desktop.ini lsass.exe File opened for modification C:\Users\Public\Desktop\desktop.ini lsass.exe File created C:\Users\Public\Videos\Sample Videos\desktop.ini lsass.exe File opened for modification C:\Users\Public\Music\desktop.ini lsass.exe File created C:\Users\Admin\Documents\desktop.ini lsass.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini lsass.exe File opened for modification C:\Users\Admin\Music\desktop.ini lsass.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini lsass.exe File opened for modification C:\Users\Admin\Searches\desktop.ini lsass.exe File created C:\Users\Admin\Searches\desktop.ini lsass.exe File created C:\Users\Public\Documents\desktop.ini lsass.exe File created C:\Users\Public\Music\desktop.ini lsass.exe File created C:\Users\Admin\Music\desktop.ini lsass.exe File created C:\Users\Admin\Pictures\desktop.ini lsass.exe File opened for modification C:\Users\Public\desktop.ini lsass.exe File created C:\Users\Public\Downloads\desktop.ini lsass.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini lsass.exe File created C:\Users\Admin\Contacts\desktop.ini lsass.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini lsass.exe File created C:\Users\Public\Libraries\desktop.ini lsass.exe File created C:\Users\Public\Pictures\Sample Pictures\desktop.ini lsass.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini lsass.exe File created C:\Users\Public\Videos\desktop.ini lsass.exe File opened for modification C:\Users\Admin\Documents\desktop.ini lsass.exe File created C:\Users\Admin\Downloads\desktop.ini lsass.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini lsass.exe File created C:\Users\Admin\Links\desktop.ini lsass.exe File created C:\Users\Admin\Videos\desktop.ini lsass.exe File opened for modification C:\Users\Public\Documents\desktop.ini lsass.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\regedit.exe lsass.exe - Drops file in Windows directory 30 IoCs
description ioc Process File opened for modification C:\Windows\DtcInstall.log lsass.exe File opened for modification C:\Windows\splwow64.exe lsass.exe File opened for modification C:\Windows\Ultimate.xml lsass.exe File opened for modification C:\Windows\WMSysPr9.prx lsass.exe File opened for modification C:\Windows\Starter.xml lsass.exe File opened for modification C:\Windows\twain.dll lsass.exe File opened for modification C:\Windows\bfsvc.exe lsass.exe File opened for modification C:\Windows\fveupdate.exe lsass.exe File opened for modification C:\Windows\twunk_16.exe lsass.exe File opened for modification C:\Windows\WindowsUpdate.log lsass.exe File opened for modification C:\Windows\explorer.exe lsass.exe File opened for modification C:\Windows\write.exe lsass.exe File opened for modification C:\Windows\bootstat.dat lsass.exe File opened for modification C:\Windows\mib.bin lsass.exe File opened for modification C:\Windows\system.ini lsass.exe File opened for modification C:\Windows\twain_32.dll lsass.exe File opened for modification C:\Windows\HelpPane.exe lsass.exe File opened for modification C:\Windows\setuperr.log lsass.exe File opened for modification C:\Windows\TSSysprep.log lsass.exe File opened for modification C:\Windows\WindowsShell.Manifest lsass.exe File opened for modification C:\Windows\hh.exe lsass.exe File opened for modification C:\Windows\setupact.log lsass.exe File opened for modification C:\Windows\twunk_32.exe lsass.exe File opened for modification C:\Windows\PFRO.log lsass.exe File opened for modification C:\Windows\win.ini lsass.exe File opened for modification C:\Windows\winhlp32.exe lsass.exe File created C:\Windows\bootstat.dat lsass.exe File created C:\Windows\@[email protected] lsass.exe File opened for modification C:\Windows\msdfmap.ini lsass.exe File opened for modification C:\Windows\notepad.exe lsass.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1980 vssadmin.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeBackupPrivilege 532 vssvc.exe Token: SeRestorePrivilege 532 vssvc.exe Token: SeAuditPrivilege 532 vssvc.exe Token: SeIncreaseQuotaPrivilege 924 WMIC.exe Token: SeSecurityPrivilege 924 WMIC.exe Token: SeTakeOwnershipPrivilege 924 WMIC.exe Token: SeLoadDriverPrivilege 924 WMIC.exe Token: SeSystemProfilePrivilege 924 WMIC.exe Token: SeSystemtimePrivilege 924 WMIC.exe Token: SeProfSingleProcessPrivilege 924 WMIC.exe Token: SeIncBasePriorityPrivilege 924 WMIC.exe Token: SeCreatePagefilePrivilege 924 WMIC.exe Token: SeBackupPrivilege 924 WMIC.exe Token: SeRestorePrivilege 924 WMIC.exe Token: SeShutdownPrivilege 924 WMIC.exe Token: SeDebugPrivilege 924 WMIC.exe Token: SeSystemEnvironmentPrivilege 924 WMIC.exe Token: SeRemoteShutdownPrivilege 924 WMIC.exe Token: SeUndockPrivilege 924 WMIC.exe Token: SeManageVolumePrivilege 924 WMIC.exe Token: 33 924 WMIC.exe Token: 34 924 WMIC.exe Token: 35 924 WMIC.exe Token: SeIncreaseQuotaPrivilege 924 WMIC.exe Token: SeSecurityPrivilege 924 WMIC.exe Token: SeTakeOwnershipPrivilege 924 WMIC.exe Token: SeLoadDriverPrivilege 924 WMIC.exe Token: SeSystemProfilePrivilege 924 WMIC.exe Token: SeSystemtimePrivilege 924 WMIC.exe Token: SeProfSingleProcessPrivilege 924 WMIC.exe Token: SeIncBasePriorityPrivilege 924 WMIC.exe Token: SeCreatePagefilePrivilege 924 WMIC.exe Token: SeBackupPrivilege 924 WMIC.exe Token: SeRestorePrivilege 924 WMIC.exe Token: SeShutdownPrivilege 924 WMIC.exe Token: SeDebugPrivilege 924 WMIC.exe Token: SeSystemEnvironmentPrivilege 924 WMIC.exe Token: SeRemoteShutdownPrivilege 924 WMIC.exe Token: SeUndockPrivilege 924 WMIC.exe Token: SeManageVolumePrivilege 924 WMIC.exe Token: 33 924 WMIC.exe Token: 34 924 WMIC.exe Token: 35 924 WMIC.exe - Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1620 wrote to memory of 1064 1620 972e65bc88e89bd5ce6bada6ba84bf9b5fb64d1b742e2b1ebf95c4926b8f2b3e.exe 27 PID 1620 wrote to memory of 1064 1620 972e65bc88e89bd5ce6bada6ba84bf9b5fb64d1b742e2b1ebf95c4926b8f2b3e.exe 27 PID 1620 wrote to memory of 1064 1620 972e65bc88e89bd5ce6bada6ba84bf9b5fb64d1b742e2b1ebf95c4926b8f2b3e.exe 27 PID 1620 wrote to memory of 1064 1620 972e65bc88e89bd5ce6bada6ba84bf9b5fb64d1b742e2b1ebf95c4926b8f2b3e.exe 27 PID 1064 wrote to memory of 1492 1064 lsass.exe 28 PID 1064 wrote to memory of 1492 1064 lsass.exe 28 PID 1064 wrote to memory of 1492 1064 lsass.exe 28 PID 1064 wrote to memory of 1492 1064 lsass.exe 28 PID 1492 wrote to memory of 1684 1492 lsass.exe 29 PID 1492 wrote to memory of 1684 1492 lsass.exe 29 PID 1492 wrote to memory of 1684 1492 lsass.exe 29 PID 1492 wrote to memory of 1684 1492 lsass.exe 29 PID 1684 wrote to memory of 1768 1684 svchost.exe 30 PID 1684 wrote to memory of 1768 1684 svchost.exe 30 PID 1684 wrote to memory of 1768 1684 svchost.exe 30 PID 1684 wrote to memory of 1768 1684 svchost.exe 30 PID 1768 wrote to memory of 1980 1768 cmd.exe 32 PID 1768 wrote to memory of 1980 1768 cmd.exe 32 PID 1768 wrote to memory of 1980 1768 cmd.exe 32 PID 1768 wrote to memory of 1980 1768 cmd.exe 32 PID 1768 wrote to memory of 924 1768 cmd.exe 35 PID 1768 wrote to memory of 924 1768 cmd.exe 35 PID 1768 wrote to memory of 924 1768 cmd.exe 35 PID 1768 wrote to memory of 924 1768 cmd.exe 35 PID 1684 wrote to memory of 1576 1684 svchost.exe 37 PID 1684 wrote to memory of 1576 1684 svchost.exe 37 PID 1684 wrote to memory of 1576 1684 svchost.exe 37 PID 1684 wrote to memory of 1576 1684 svchost.exe 37 PID 1684 wrote to memory of 1848 1684 svchost.exe 39 PID 1684 wrote to memory of 1848 1684 svchost.exe 39 PID 1684 wrote to memory of 1848 1684 svchost.exe 39 PID 1684 wrote to memory of 1848 1684 svchost.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\972e65bc88e89bd5ce6bada6ba84bf9b5fb64d1b742e2b1ebf95c4926b8f2b3e.exe"C:\Users\Admin\AppData\Local\Temp\972e65bc88e89bd5ce6bada6ba84bf9b5fb64d1b742e2b1ebf95c4926b8f2b3e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\lsass.exe"C:\Users\Admin\AppData\Local\lsass.exe" /a2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\lsass.exe"C:\Users\Admin\AppData\Local\lsass.exe" /c3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe" /x4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete5⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet6⤵
- Interacts with shadow copies
PID:1980
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete6⤵
- Suspicious use of AdjustPrivilegeToken
PID:924
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no5⤵PID:1576
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet5⤵PID:1848
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:532