Analysis
- max time kernel
119s - max time network
119s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
05/01/2022, 06:23
Static task
static1
Behavioral task
behavioral1
Sample
972e65bc88e89bd5ce6bada6ba84bf9b5fb64d1b742e2b1ebf95c4926b8f2b3e.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
972e65bc88e89bd5ce6bada6ba84bf9b5fb64d1b742e2b1ebf95c4926b8f2b3e.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target 972e65bc88e89bd5ce6bada6ba84bf9b5fb64d1b742e2b1ebf95c4926b8f2b3e.exe
- Size 19KB
- Sample220105-g5gfeaachk
- SHA256 972e65bc88e89bd5ce6bada6ba84bf9b5fb64d1b742e2b1ebf95c4926b8f2b3e
- MD5 861a2d95cf43c1489f1fdb95301d5190
- SHA1 9286e26e0ba3210a6fdb139b0fb9846d6a3c64dd
- SHA512 bcd3ebffeb809773f09c44dc049dafc63a6a312bff380266a54cc9bffb8c2e7b888f164b1d8c24cccfb34d5a22f2751e2c12f0fddcd1705cedd4b05eb49a099b
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\.oracle_jre_usage\@[email protected]
Ransom Note
- ---------------Time Time Ransomware--------------- All of your document,pictures,videos are no longer accessible. We encrypted them ! We also stole your files,computer information,passwords,cookies. If you don't pay us, we will leak everything on the dark web. Please, find @[email protected] on your desktop to pay the ransom. If you don't find it, check your recycle bin or antivirus quarantine. We ask for 100€ of paysafecard (https://paysafecard.com) /!\ Warning /!\ Please, do not rename encrypted files. Do not use third party software. Do not try to decrypt the files yourself. /!\ Warning /!\ You got epicly pwned. ---------------Time Time Ransomware---------------
URLs
-
https://paysafecard.com
Signatures
- Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Executes dropped EXE 3 IoCs
pid Process 3016 lsass.exe 2252 lsass.exe 68 svchost.exe - Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\DisableOptimize.tif => C:\Users\Admin\Pictures\DisableOptimize.tif.timetime lsass.exe File renamed C:\Users\Admin\Pictures\StartResize.png => C:\Users\Admin\Pictures\StartResize.png.timetime lsass.exe File opened for modification C:\Users\Admin\Pictures\UnregisterGrant.tiff lsass.exe File renamed C:\Users\Admin\Pictures\UnregisterGrant.tiff => C:\Users\Admin\Pictures\UnregisterGrant.tiff.timetime lsass.exe File renamed C:\Users\Admin\Pictures\UnprotectComplete.png => C:\Users\Admin\Pictures\UnprotectComplete.png.timetime lsass.exe File renamed C:\Users\Admin\Pictures\ConvertFromAssert.tif => C:\Users\Admin\Pictures\ConvertFromAssert.tif.timetime lsass.exe File renamed C:\Users\Admin\Pictures\SkipComplete.raw => C:\Users\Admin\Pictures\SkipComplete.raw.timetime lsass.exe File renamed C:\Users\Admin\Pictures\SwitchGroup.png => C:\Users\Admin\Pictures\SwitchGroup.png.timetime lsass.exe File renamed C:\Users\Admin\Pictures\SyncDisable.crw => C:\Users\Admin\Pictures\SyncDisable.crw.timetime lsass.exe - Drops desktop.ini file(s) 48 IoCs
description ioc Process File created C:\Users\Public\desktop.ini lsass.exe File created C:\Users\Public\Documents\desktop.ini lsass.exe File created C:\Users\Public\Pictures\desktop.ini lsass.exe File opened for modification C:\Users\Admin\Documents\desktop.ini lsass.exe File created C:\Users\Admin\OneDrive\desktop.ini lsass.exe File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini lsass.exe File opened for modification C:\Users\Public\Downloads\desktop.ini lsass.exe File opened for modification C:\Users\Public\Music\desktop.ini lsass.exe File created C:\Users\Admin\Downloads\desktop.ini lsass.exe File created C:\Users\Admin\Favorites\Links\desktop.ini lsass.exe File created C:\Users\Public\AccountPictures\desktop.ini lsass.exe File created C:\Users\Public\Downloads\desktop.ini lsass.exe File created C:\Users\Admin\Links\desktop.ini lsass.exe File opened for modification C:\Users\Admin\Music\desktop.ini lsass.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini lsass.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini lsass.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini lsass.exe File opened for modification C:\Users\Admin\Videos\desktop.ini lsass.exe File created C:\Users\Admin\Pictures\desktop.ini lsass.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini lsass.exe File opened for modification C:\Users\Public\Documents\desktop.ini lsass.exe File created C:\Users\Admin\Favorites\desktop.ini lsass.exe File opened for modification C:\Users\Admin\Links\desktop.ini lsass.exe File created C:\Users\Admin\Music\desktop.ini lsass.exe File created C:\Users\Admin\Searches\desktop.ini lsass.exe File created C:\Users\Admin\Videos\desktop.ini lsass.exe File created C:\Users\Public\Desktop\desktop.ini lsass.exe File opened for modification C:\Users\Public\Libraries\desktop.ini lsass.exe File opened for modification C:\Users\Public\Pictures\desktop.ini lsass.exe File created C:\Users\Admin\Contacts\desktop.ini lsass.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini lsass.exe File created C:\Users\Admin\Saved Games\desktop.ini lsass.exe File opened for modification C:\Users\Public\Videos\desktop.ini lsass.exe File created C:\Users\Public\Videos\desktop.ini lsass.exe File opened for modification C:\Users\Admin\Searches\desktop.ini lsass.exe File opened for modification C:\Users\Public\desktop.ini lsass.exe File opened for modification C:\Users\Public\Desktop\desktop.ini lsass.exe File created C:\Users\Public\Libraries\desktop.ini lsass.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini lsass.exe File created C:\Users\Admin\Desktop\desktop.ini lsass.exe File created C:\Users\Admin\Documents\desktop.ini lsass.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini lsass.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini lsass.exe File created C:\Users\Admin\Pictures\Saved Pictures\desktop.ini lsass.exe File created C:\Users\Public\Music\desktop.ini lsass.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini lsass.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini lsass.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini lsass.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\regedit.exe lsass.exe - Drops file in Windows directory 24 IoCs
description ioc Process File opened for modification C:\Windows\setupact.log lsass.exe File opened for modification C:\Windows\setuperr.log lsass.exe File opened for modification C:\Windows\WindowsShell.Manifest lsass.exe File opened for modification C:\Windows\WMSysPr9.prx lsass.exe File opened for modification C:\Windows\write.exe lsass.exe File created C:\Windows\@[email protected] lsass.exe File opened for modification C:\Windows\explorer.exe lsass.exe File opened for modification C:\Windows\lsasetup.log lsass.exe File opened for modification C:\Windows\splwow64.exe lsass.exe File opened for modification C:\Windows\WindowsUpdate.log lsass.exe File opened for modification C:\Windows\bfsvc.exe lsass.exe File opened for modification C:\Windows\DtcInstall.log lsass.exe File opened for modification C:\Windows\hh.exe lsass.exe File opened for modification C:\Windows\system.ini lsass.exe File opened for modification C:\Windows\win.ini lsass.exe File opened for modification C:\Windows\winhlp32.exe lsass.exe File created C:\Windows\bootstat.dat lsass.exe File opened for modification C:\Windows\HelpPane.exe lsass.exe File opened for modification C:\Windows\mib.bin lsass.exe File opened for modification C:\Windows\notepad.exe lsass.exe File opened for modification C:\Windows\PFRO.log lsass.exe File opened for modification C:\Windows\Professional.xml lsass.exe File opened for modification C:\Windows\twain_32.dll lsass.exe File opened for modification C:\Windows\bootstat.dat lsass.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3120 vssadmin.exe - Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeBackupPrivilege 1272 vssvc.exe Token: SeRestorePrivilege 1272 vssvc.exe Token: SeAuditPrivilege 1272 vssvc.exe Token: SeIncreaseQuotaPrivilege 1364 WMIC.exe Token: SeSecurityPrivilege 1364 WMIC.exe Token: SeTakeOwnershipPrivilege 1364 WMIC.exe Token: SeLoadDriverPrivilege 1364 WMIC.exe Token: SeSystemProfilePrivilege 1364 WMIC.exe Token: SeSystemtimePrivilege 1364 WMIC.exe Token: SeProfSingleProcessPrivilege 1364 WMIC.exe Token: SeIncBasePriorityPrivilege 1364 WMIC.exe Token: SeCreatePagefilePrivilege 1364 WMIC.exe Token: SeBackupPrivilege 1364 WMIC.exe Token: SeRestorePrivilege 1364 WMIC.exe Token: SeShutdownPrivilege 1364 WMIC.exe Token: SeDebugPrivilege 1364 WMIC.exe Token: SeSystemEnvironmentPrivilege 1364 WMIC.exe Token: SeRemoteShutdownPrivilege 1364 WMIC.exe Token: SeUndockPrivilege 1364 WMIC.exe Token: SeManageVolumePrivilege 1364 WMIC.exe Token: 33 1364 WMIC.exe Token: 34 1364 WMIC.exe Token: 35 1364 WMIC.exe Token: 36 1364 WMIC.exe Token: SeIncreaseQuotaPrivilege 1364 WMIC.exe Token: SeSecurityPrivilege 1364 WMIC.exe Token: SeTakeOwnershipPrivilege 1364 WMIC.exe Token: SeLoadDriverPrivilege 1364 WMIC.exe Token: SeSystemProfilePrivilege 1364 WMIC.exe Token: SeSystemtimePrivilege 1364 WMIC.exe Token: SeProfSingleProcessPrivilege 1364 WMIC.exe Token: SeIncBasePriorityPrivilege 1364 WMIC.exe Token: SeCreatePagefilePrivilege 1364 WMIC.exe Token: SeBackupPrivilege 1364 WMIC.exe Token: SeRestorePrivilege 1364 WMIC.exe Token: SeShutdownPrivilege 1364 WMIC.exe Token: SeDebugPrivilege 1364 WMIC.exe Token: SeSystemEnvironmentPrivilege 1364 WMIC.exe Token: SeRemoteShutdownPrivilege 1364 WMIC.exe Token: SeUndockPrivilege 1364 WMIC.exe Token: SeManageVolumePrivilege 1364 WMIC.exe Token: 33 1364 WMIC.exe Token: 34 1364 WMIC.exe Token: 35 1364 WMIC.exe Token: 36 1364 WMIC.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2444 wrote to memory of 3016 2444 972e65bc88e89bd5ce6bada6ba84bf9b5fb64d1b742e2b1ebf95c4926b8f2b3e.exe 68 PID 2444 wrote to memory of 3016 2444 972e65bc88e89bd5ce6bada6ba84bf9b5fb64d1b742e2b1ebf95c4926b8f2b3e.exe 68 PID 2444 wrote to memory of 3016 2444 972e65bc88e89bd5ce6bada6ba84bf9b5fb64d1b742e2b1ebf95c4926b8f2b3e.exe 68 PID 3016 wrote to memory of 2252 3016 lsass.exe 69 PID 3016 wrote to memory of 2252 3016 lsass.exe 69 PID 3016 wrote to memory of 2252 3016 lsass.exe 69 PID 2252 wrote to memory of 68 2252 lsass.exe 70 PID 2252 wrote to memory of 68 2252 lsass.exe 70 PID 2252 wrote to memory of 68 2252 lsass.exe 70 PID 68 wrote to memory of 3240 68 svchost.exe 71 PID 68 wrote to memory of 3240 68 svchost.exe 71 PID 68 wrote to memory of 3240 68 svchost.exe 71 PID 3240 wrote to memory of 3120 3240 cmd.exe 74 PID 3240 wrote to memory of 3120 3240 cmd.exe 74 PID 3240 wrote to memory of 3120 3240 cmd.exe 74 PID 3240 wrote to memory of 1364 3240 cmd.exe 76 PID 3240 wrote to memory of 1364 3240 cmd.exe 76 PID 3240 wrote to memory of 1364 3240 cmd.exe 76 PID 68 wrote to memory of 2248 68 svchost.exe 78 PID 68 wrote to memory of 2248 68 svchost.exe 78 PID 68 wrote to memory of 2248 68 svchost.exe 78 PID 68 wrote to memory of 644 68 svchost.exe 80 PID 68 wrote to memory of 644 68 svchost.exe 80 PID 68 wrote to memory of 644 68 svchost.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\972e65bc88e89bd5ce6bada6ba84bf9b5fb64d1b742e2b1ebf95c4926b8f2b3e.exe"C:\Users\Admin\AppData\Local\Temp\972e65bc88e89bd5ce6bada6ba84bf9b5fb64d1b742e2b1ebf95c4926b8f2b3e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\lsass.exe"C:\Users\Admin\AppData\Local\lsass.exe" /a2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\lsass.exe"C:\Users\Admin\AppData\Local\lsass.exe" /c3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe" /x4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:68 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete5⤵
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet6⤵
- Interacts with shadow copies
PID:3120
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete6⤵
- Suspicious use of AdjustPrivilegeToken
PID:1364
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no5⤵PID:2248
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet5⤵PID:644
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1272