Analysis
-
max time kernel
104s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
03-05-2022 15:11
Static task
static1
Behavioral task
behavioral1
Sample
761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997.exe
Resource
win10v2004-20220414-en
General
-
Target
761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997.exe
-
Size
2.6MB
-
MD5
678c88c9fa4bd905d617530e3ed3f092
-
SHA1
f2019598e111d8833fb0a7b663e5035a3db47eac
-
SHA256
761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997
-
SHA512
aa1b26d398f273a838d6623701ba84314cc691c4bbbc51703af34ad3d5f503a66dc42fb5838e66f4e84004aaf23e29caf6113a8b17891179b62fd3d7773cde5d
Malware Config
Signatures
-
WastedLocker
Ransomware family seen in the wild since May 2020.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Executes dropped EXE 2 IoCs
Processes:
Join:binJoin.exepid process 220 Join:bin 664 Join.exe -
Modifies extensions of user files 21 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
Join.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\EditMerge.raw.tcwwasted Join.exe File opened for modification C:\Users\Admin\Pictures\ImportFormat.crw.tcwwasted Join.exe File opened for modification C:\Users\Admin\Pictures\StartMount.tiff.tcwwasted Join.exe File renamed C:\Users\Admin\Pictures\ConnectFind.raw => C:\Users\Admin\Pictures\ConnectFind.raw.tcwwasted Join.exe File opened for modification C:\Users\Admin\Pictures\ConnectFind.raw.tcwwasted Join.exe File opened for modification C:\Users\Admin\Pictures\CopyRequest.tiff.tcwwasted Join.exe File created C:\Users\Admin\Pictures\EditMerge.raw.tcwwasted_info Join.exe File opened for modification C:\Users\Admin\Pictures\LimitClose.png.tcwwasted Join.exe File created C:\Users\Admin\Pictures\StepWatch.tiff.tcwwasted_info Join.exe File renamed C:\Users\Admin\Pictures\StepWatch.tiff => C:\Users\Admin\Pictures\StepWatch.tiff.tcwwasted Join.exe File created C:\Users\Admin\Pictures\ConnectFind.raw.tcwwasted_info Join.exe File renamed C:\Users\Admin\Pictures\CopyRequest.tiff => C:\Users\Admin\Pictures\CopyRequest.tiff.tcwwasted Join.exe File created C:\Users\Admin\Pictures\LimitClose.png.tcwwasted_info Join.exe File created C:\Users\Admin\Pictures\CopyRequest.tiff.tcwwasted_info Join.exe File created C:\Users\Admin\Pictures\ImportFormat.crw.tcwwasted_info Join.exe File renamed C:\Users\Admin\Pictures\ImportFormat.crw => C:\Users\Admin\Pictures\ImportFormat.crw.tcwwasted Join.exe File renamed C:\Users\Admin\Pictures\LimitClose.png => C:\Users\Admin\Pictures\LimitClose.png.tcwwasted Join.exe File created C:\Users\Admin\Pictures\StartMount.tiff.tcwwasted_info Join.exe File renamed C:\Users\Admin\Pictures\StartMount.tiff => C:\Users\Admin\Pictures\StartMount.tiff.tcwwasted Join.exe File opened for modification C:\Users\Admin\Pictures\StepWatch.tiff.tcwwasted Join.exe File renamed C:\Users\Admin\Pictures\EditMerge.raw => C:\Users\Admin\Pictures\EditMerge.raw.tcwwasted Join.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 4792 takeown.exe 3544 icacls.exe -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997.exeJoin:binJoin.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Join:bin Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Join:bin Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Join.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Join.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 4792 takeown.exe 3544 icacls.exe -
Processes:
resource yara_rule behavioral2/memory/4400-132-0x0000000000400000-0x0000000000A45000-memory.dmp themida C:\Users\Admin\AppData\Roaming\Join:bin themida C:\Users\Admin\AppData\Roaming\Join:bin themida behavioral2/memory/220-140-0x0000000000400000-0x0000000000A45000-memory.dmp themida C:\Windows\SysWOW64\Join.exe themida C:\Windows\SysWOW64\Join.exe themida behavioral2/memory/664-149-0x0000000000400000-0x0000000000A45000-memory.dmp themida -
Processes:
761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997.exeJoin:binJoin.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Join:bin Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Join.exe -
Drops file in System32 directory 2 IoCs
Processes:
Join:binattrib.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Join.exe Join:bin File opened for modification C:\Windows\SysWOW64\Join.exe attrib.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997.exeJoin:binJoin.exepid process 4400 761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997.exe 220 Join:bin 664 Join.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 860 vssadmin.exe -
NTFS ADS 1 IoCs
Processes:
761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Join:bin 761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 4320 vssvc.exe Token: SeRestorePrivilege 4320 vssvc.exe Token: SeAuditPrivilege 4320 vssvc.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997.exeJoin:binJoin.execmd.execmd.execmd.exedescription pid process target process PID 4400 wrote to memory of 220 4400 761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997.exe Join:bin PID 4400 wrote to memory of 220 4400 761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997.exe Join:bin PID 4400 wrote to memory of 220 4400 761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997.exe Join:bin PID 220 wrote to memory of 860 220 Join:bin vssadmin.exe PID 220 wrote to memory of 860 220 Join:bin vssadmin.exe PID 220 wrote to memory of 4792 220 Join:bin takeown.exe PID 220 wrote to memory of 4792 220 Join:bin takeown.exe PID 220 wrote to memory of 4792 220 Join:bin takeown.exe PID 220 wrote to memory of 3544 220 Join:bin icacls.exe PID 220 wrote to memory of 3544 220 Join:bin icacls.exe PID 220 wrote to memory of 3544 220 Join:bin icacls.exe PID 220 wrote to memory of 1256 220 Join:bin cmd.exe PID 664 wrote to memory of 4700 664 Join.exe cmd.exe PID 220 wrote to memory of 1256 220 Join:bin cmd.exe PID 220 wrote to memory of 1256 220 Join:bin cmd.exe PID 664 wrote to memory of 4700 664 Join.exe cmd.exe PID 664 wrote to memory of 4700 664 Join.exe cmd.exe PID 4700 wrote to memory of 1960 4700 cmd.exe choice.exe PID 4700 wrote to memory of 1960 4700 cmd.exe choice.exe PID 4700 wrote to memory of 1960 4700 cmd.exe choice.exe PID 1256 wrote to memory of 620 1256 cmd.exe choice.exe PID 1256 wrote to memory of 620 1256 cmd.exe choice.exe PID 1256 wrote to memory of 620 1256 cmd.exe choice.exe PID 4400 wrote to memory of 1060 4400 761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997.exe cmd.exe PID 4400 wrote to memory of 1060 4400 761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997.exe cmd.exe PID 4400 wrote to memory of 1060 4400 761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997.exe cmd.exe PID 1060 wrote to memory of 4316 1060 cmd.exe choice.exe PID 1060 wrote to memory of 4316 1060 cmd.exe choice.exe PID 1060 wrote to memory of 4316 1060 cmd.exe choice.exe PID 1256 wrote to memory of 1260 1256 cmd.exe attrib.exe PID 1256 wrote to memory of 1260 1256 cmd.exe attrib.exe PID 1256 wrote to memory of 1260 1256 cmd.exe attrib.exe PID 4700 wrote to memory of 2204 4700 cmd.exe attrib.exe PID 4700 wrote to memory of 2204 4700 cmd.exe attrib.exe PID 4700 wrote to memory of 2204 4700 cmd.exe attrib.exe PID 1060 wrote to memory of 3240 1060 cmd.exe attrib.exe PID 1060 wrote to memory of 3240 1060 cmd.exe attrib.exe PID 1060 wrote to memory of 3240 1060 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 3 IoCs
Processes:
attrib.exeattrib.exeattrib.exepid process 2204 attrib.exe 1260 attrib.exe 3240 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997.exe"C:\Users\Admin\AppData\Local\Temp\761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Join:binC:\Users\Admin\AppData\Roaming\Join:bin -r2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\takeown.exeC:\Windows\system32\takeown.exe /F C:\Windows\system32\Join.exe3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\icacls.exeC:\Windows\system32\icacls.exe C:\Windows\system32\Join.exe /reset3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Roaming\Join" & del "C:\Users\Admin\AppData\Roaming\Join"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y4⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Roaming\Join"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997.exe" & del "C:\Users\Admin\AppData\Local\Temp\761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Local\Temp\761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997.exe"3⤵
- Views/modifies file attributes
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Join.exeC:\Windows\SysWOW64\Join.exe -s1⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Windows\SysWOW64\Join.exe" & del "C:\Windows\SysWOW64\Join.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Windows\SysWOW64\Join.exe"3⤵
- Drops file in System32 directory
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Join:binFilesize
2.6MB
MD5678c88c9fa4bd905d617530e3ed3f092
SHA1f2019598e111d8833fb0a7b663e5035a3db47eac
SHA256761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997
SHA512aa1b26d398f273a838d6623701ba84314cc691c4bbbc51703af34ad3d5f503a66dc42fb5838e66f4e84004aaf23e29caf6113a8b17891179b62fd3d7773cde5d
-
C:\Users\Admin\AppData\Roaming\Join:binFilesize
2.6MB
MD5678c88c9fa4bd905d617530e3ed3f092
SHA1f2019598e111d8833fb0a7b663e5035a3db47eac
SHA256761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997
SHA512aa1b26d398f273a838d6623701ba84314cc691c4bbbc51703af34ad3d5f503a66dc42fb5838e66f4e84004aaf23e29caf6113a8b17891179b62fd3d7773cde5d
-
C:\Windows\SysWOW64\Join.exeFilesize
2.6MB
MD5678c88c9fa4bd905d617530e3ed3f092
SHA1f2019598e111d8833fb0a7b663e5035a3db47eac
SHA256761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997
SHA512aa1b26d398f273a838d6623701ba84314cc691c4bbbc51703af34ad3d5f503a66dc42fb5838e66f4e84004aaf23e29caf6113a8b17891179b62fd3d7773cde5d
-
C:\Windows\SysWOW64\Join.exeFilesize
2.6MB
MD5678c88c9fa4bd905d617530e3ed3f092
SHA1f2019598e111d8833fb0a7b663e5035a3db47eac
SHA256761fe7fde9899b8482bcd2a1800c442201cc866fb8e0e28969474d51fb412997
SHA512aa1b26d398f273a838d6623701ba84314cc691c4bbbc51703af34ad3d5f503a66dc42fb5838e66f4e84004aaf23e29caf6113a8b17891179b62fd3d7773cde5d
-
memory/220-140-0x0000000000400000-0x0000000000A45000-memory.dmpFilesize
6.3MB
-
memory/220-143-0x0000000000400000-0x0000000000A45000-memory.dmpFilesize
6.3MB
-
memory/220-141-0x0000000076FD0000-0x0000000077173000-memory.dmpFilesize
1.6MB
-
memory/220-136-0x0000000000000000-mapping.dmp
-
memory/620-155-0x0000000000000000-mapping.dmp
-
memory/664-149-0x0000000000400000-0x0000000000A45000-memory.dmpFilesize
6.3MB
-
memory/664-150-0x0000000076FD0000-0x0000000077173000-memory.dmpFilesize
1.6MB
-
memory/664-151-0x0000000000400000-0x0000000000A45000-memory.dmpFilesize
6.3MB
-
memory/860-142-0x0000000000000000-mapping.dmp
-
memory/1060-156-0x0000000000000000-mapping.dmp
-
memory/1256-152-0x0000000000000000-mapping.dmp
-
memory/1260-158-0x0000000000000000-mapping.dmp
-
memory/1960-154-0x0000000000000000-mapping.dmp
-
memory/2204-159-0x0000000000000000-mapping.dmp
-
memory/3240-160-0x0000000000000000-mapping.dmp
-
memory/3544-146-0x0000000000000000-mapping.dmp
-
memory/4316-157-0x0000000000000000-mapping.dmp
-
memory/4400-133-0x0000000076FD0000-0x0000000077173000-memory.dmpFilesize
1.6MB
-
memory/4400-131-0x0000000000401000-0x0000000000403000-memory.dmpFilesize
8KB
-
memory/4400-132-0x0000000000400000-0x0000000000A45000-memory.dmpFilesize
6.3MB
-
memory/4400-135-0x0000000000400000-0x0000000000A45000-memory.dmpFilesize
6.3MB
-
memory/4400-134-0x0000000002F10000-0x0000000002F22000-memory.dmpFilesize
72KB
-
memory/4700-153-0x0000000000000000-mapping.dmp
-
memory/4792-144-0x0000000000000000-mapping.dmp