Analysis
-
max time kernel
156s -
max time network
175s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
16-02-2022 22:56
Static task
static1
Behavioral task
behavioral1
Sample
639af330da2d4389a6ecb1c3e26e5449c3c4fae7f198d158cbcdadc9466d1bcc.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
639af330da2d4389a6ecb1c3e26e5449c3c4fae7f198d158cbcdadc9466d1bcc.exe
Resource
win10v2004-en-20220113
General
-
Target
639af330da2d4389a6ecb1c3e26e5449c3c4fae7f198d158cbcdadc9466d1bcc.exe
-
Size
346KB
-
MD5
8afc9f287ef0f3495b259e497b30f39e
-
SHA1
bba18a946f11439c766478236b33b3bfcdc2c4fc
-
SHA256
639af330da2d4389a6ecb1c3e26e5449c3c4fae7f198d158cbcdadc9466d1bcc
-
SHA512
ca44ca63b5f152ceb8fa988f52f42e0b63ade0d11e2ea023532a2640813235ee0ad5171ddd255e8b86c6686ade64218f3e3c591744a4cf5ba04978f3c14b6d69
Malware Config
Extracted
C:\DECRYPT-FILES.html
koreadec@tutanota.com<br>Reserve
yourrealdecrypt@airmail.cc</b></u>
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
639af330da2d4389a6ecb1c3e26e5449c3c4fae7f198d158cbcdadc9466d1bcc.exepid process 1620 639af330da2d4389a6ecb1c3e26e5449c3c4fae7f198d158cbcdadc9466d1bcc.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
Processes:
wmic.exevssvc.exedescription pid process Token: SeIncreaseQuotaPrivilege 684 wmic.exe Token: SeSecurityPrivilege 684 wmic.exe Token: SeTakeOwnershipPrivilege 684 wmic.exe Token: SeLoadDriverPrivilege 684 wmic.exe Token: SeSystemProfilePrivilege 684 wmic.exe Token: SeSystemtimePrivilege 684 wmic.exe Token: SeProfSingleProcessPrivilege 684 wmic.exe Token: SeIncBasePriorityPrivilege 684 wmic.exe Token: SeCreatePagefilePrivilege 684 wmic.exe Token: SeBackupPrivilege 684 wmic.exe Token: SeRestorePrivilege 684 wmic.exe Token: SeShutdownPrivilege 684 wmic.exe Token: SeDebugPrivilege 684 wmic.exe Token: SeSystemEnvironmentPrivilege 684 wmic.exe Token: SeRemoteShutdownPrivilege 684 wmic.exe Token: SeUndockPrivilege 684 wmic.exe Token: SeManageVolumePrivilege 684 wmic.exe Token: 33 684 wmic.exe Token: 34 684 wmic.exe Token: 35 684 wmic.exe Token: SeIncreaseQuotaPrivilege 684 wmic.exe Token: SeSecurityPrivilege 684 wmic.exe Token: SeTakeOwnershipPrivilege 684 wmic.exe Token: SeLoadDriverPrivilege 684 wmic.exe Token: SeSystemProfilePrivilege 684 wmic.exe Token: SeSystemtimePrivilege 684 wmic.exe Token: SeProfSingleProcessPrivilege 684 wmic.exe Token: SeIncBasePriorityPrivilege 684 wmic.exe Token: SeCreatePagefilePrivilege 684 wmic.exe Token: SeBackupPrivilege 684 wmic.exe Token: SeRestorePrivilege 684 wmic.exe Token: SeShutdownPrivilege 684 wmic.exe Token: SeDebugPrivilege 684 wmic.exe Token: SeSystemEnvironmentPrivilege 684 wmic.exe Token: SeRemoteShutdownPrivilege 684 wmic.exe Token: SeUndockPrivilege 684 wmic.exe Token: SeManageVolumePrivilege 684 wmic.exe Token: 33 684 wmic.exe Token: 34 684 wmic.exe Token: 35 684 wmic.exe Token: SeBackupPrivilege 1824 vssvc.exe Token: SeRestorePrivilege 1824 vssvc.exe Token: SeAuditPrivilege 1824 vssvc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
639af330da2d4389a6ecb1c3e26e5449c3c4fae7f198d158cbcdadc9466d1bcc.exedescription pid process target process PID 1620 wrote to memory of 684 1620 639af330da2d4389a6ecb1c3e26e5449c3c4fae7f198d158cbcdadc9466d1bcc.exe wmic.exe PID 1620 wrote to memory of 684 1620 639af330da2d4389a6ecb1c3e26e5449c3c4fae7f198d158cbcdadc9466d1bcc.exe wmic.exe PID 1620 wrote to memory of 684 1620 639af330da2d4389a6ecb1c3e26e5449c3c4fae7f198d158cbcdadc9466d1bcc.exe wmic.exe PID 1620 wrote to memory of 684 1620 639af330da2d4389a6ecb1c3e26e5449c3c4fae7f198d158cbcdadc9466d1bcc.exe wmic.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\639af330da2d4389a6ecb1c3e26e5449c3c4fae7f198d158cbcdadc9466d1bcc.exe"C:\Users\Admin\AppData\Local\Temp\639af330da2d4389a6ecb1c3e26e5449c3c4fae7f198d158cbcdadc9466d1bcc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wbem\wmic.exe"C:\l\oissm\..\..\Windows\mrdt\s\..\..\system32\yrq\hqvt\bkkq\..\..\..\wbem\spv\..\wmic.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1620-55-0x0000000076921000-0x0000000076923000-memory.dmpFilesize
8KB