0f1bf8c193b4aa0ec51cbcfe3fa36188c0479291df077ed0ffe37d78db8eaf6f

General

Target

wtava.bin.exe
Size

1.1MB
MD5

6c660f960daac148be75427c712d0134
SHA1

b3c597060abc20d3b3291f8b5252a3834d49b92f
SHA256

fa4626e2c5984d7868a685c5102530bd8260d0b31ef06d2ce2da7636da48d2d6
SHA512

48806df9787497cbf55a85a523c8e703aec1bb262c60a019ab45f420a87d016054a97dc428484bd5c2f7ba1c3f57a37d807fc4e1de487dbef1c76dc38fbf8fe0

Score

10^/10

evasion trojan persistence ransomware

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

wtava.bin.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wtava.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wtava.bin.exe

Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082
Drops desktop.ini file(s) 1 IoCs

Processes:

wtava.bin.exe

description ioc process

File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-910373003-3952921535-3480519689-1000\desktop.ini wtava.bin.exe

description	ioc	process
File opened for modification	\??\Z:\$RECYCLE.BIN\S-1-5-21-910373003-3952921535-3480519689-1000\desktop.ini	wtava.bin.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

wtava.bin.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	wtava.bin.exe

Suspicious behavior: EnumeratesProcesses 971 IoCs

Processes:

wtava.bin.exe

pid	process
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe
1360	wtava.bin.exe

Modifies service 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Suspicious use of AdjustPrivilegeToken 63 IoCs

Processes:

wmic.exevssvc.exewmic.exewmic.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1384	wmic.exe
Token: SeSecurityPrivilege	1384	wmic.exe
Token: SeTakeOwnershipPrivilege	1384	wmic.exe
Token: SeLoadDriverPrivilege	1384	wmic.exe
Token: SeSystemProfilePrivilege	1384	wmic.exe
Token: SeSystemtimePrivilege	1384	wmic.exe
Token: SeProfSingleProcessPrivilege	1384	wmic.exe
Token: SeIncBasePriorityPrivilege	1384	wmic.exe
Token: SeCreatePagefilePrivilege	1384	wmic.exe
Token: SeBackupPrivilege	1384	wmic.exe
Token: SeRestorePrivilege	1384	wmic.exe
Token: SeShutdownPrivilege	1384	wmic.exe
Token: SeDebugPrivilege	1384	wmic.exe
Token: SeSystemEnvironmentPrivilege	1384	wmic.exe
Token: SeRemoteShutdownPrivilege	1384	wmic.exe
Token: SeUndockPrivilege	1384	wmic.exe
Token: SeManageVolumePrivilege	1384	wmic.exe
Token: 33	1384	wmic.exe
Token: 34	1384	wmic.exe
Token: 35	1384	wmic.exe
Token: SeBackupPrivilege	520	vssvc.exe
Token: SeRestorePrivilege	520	vssvc.exe
Token: SeAuditPrivilege	520	vssvc.exe
Token: SeIncreaseQuotaPrivilege	556	wmic.exe
Token: SeSecurityPrivilege	556	wmic.exe
Token: SeTakeOwnershipPrivilege	556	wmic.exe
Token: SeLoadDriverPrivilege	556	wmic.exe
Token: SeSystemProfilePrivilege	556	wmic.exe
Token: SeSystemtimePrivilege	556	wmic.exe
Token: SeProfSingleProcessPrivilege	556	wmic.exe
Token: SeIncBasePriorityPrivilege	556	wmic.exe
Token: SeCreatePagefilePrivilege	556	wmic.exe
Token: SeBackupPrivilege	556	wmic.exe
Token: SeRestorePrivilege	556	wmic.exe
Token: SeShutdownPrivilege	556	wmic.exe
Token: SeDebugPrivilege	556	wmic.exe
Token: SeSystemEnvironmentPrivilege	556	wmic.exe
Token: SeRemoteShutdownPrivilege	556	wmic.exe
Token: SeUndockPrivilege	556	wmic.exe
Token: SeManageVolumePrivilege	556	wmic.exe
Token: 33	556	wmic.exe
Token: 34	556	wmic.exe
Token: 35	556	wmic.exe
Token: SeIncreaseQuotaPrivilege	1608	wmic.exe
Token: SeSecurityPrivilege	1608	wmic.exe
Token: SeTakeOwnershipPrivilege	1608	wmic.exe
Token: SeLoadDriverPrivilege	1608	wmic.exe
Token: SeSystemProfilePrivilege	1608	wmic.exe
Token: SeSystemtimePrivilege	1608	wmic.exe
Token: SeProfSingleProcessPrivilege	1608	wmic.exe
Token: SeIncBasePriorityPrivilege	1608	wmic.exe
Token: SeCreatePagefilePrivilege	1608	wmic.exe
Token: SeBackupPrivilege	1608	wmic.exe
Token: SeRestorePrivilege	1608	wmic.exe
Token: SeShutdownPrivilege	1608	wmic.exe
Token: SeDebugPrivilege	1608	wmic.exe
Token: SeSystemEnvironmentPrivilege	1608	wmic.exe
Token: SeRemoteShutdownPrivilege	1608	wmic.exe
Token: SeUndockPrivilege	1608	wmic.exe
Token: SeManageVolumePrivilege	1608	wmic.exe
Token: 33	1608	wmic.exe
Token: 34	1608	wmic.exe
Token: 35	1608	wmic.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 api.myip.com
4 api.myip.com
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

wtava.bin.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wtava.bin.exe
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exe

pid process

1544 vssadmin.exe
1780 vssadmin.exe
532 vssadmin.exe
Executes dropped EXE 1 IoCs

Processes:

wtava.bin.exe

pid process

1220 wtava.bin.exe

flow	ioc
2	api.myip.com
4	api.myip.com

pid	process
1544	vssadmin.exe
1780	vssadmin.exe
532	vssadmin.exe

pid	process
1220	wtava.bin.exe

Adds Run entry to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wtava.bin.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run	wtava.bin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\wtava.bin.exe"	wtava.bin.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	wtava.bin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\wtava.bin.exe"	wtava.bin.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

wtava.bin.exetaskeng.exe

description	pid	process	target process
PID 1360 wrote to memory of 1384	1360	wtava.bin.exe	wmic.exe
PID 1360 wrote to memory of 1384	1360	wtava.bin.exe	wmic.exe
PID 1360 wrote to memory of 1384	1360	wtava.bin.exe	wmic.exe
PID 1360 wrote to memory of 1384	1360	wtava.bin.exe	wmic.exe
PID 1360 wrote to memory of 1780	1360	wtava.bin.exe	vssadmin.exe
PID 1360 wrote to memory of 1780	1360	wtava.bin.exe	vssadmin.exe
PID 1360 wrote to memory of 1780	1360	wtava.bin.exe	vssadmin.exe
PID 1360 wrote to memory of 1780	1360	wtava.bin.exe	vssadmin.exe
PID 1360 wrote to memory of 556	1360	wtava.bin.exe	wmic.exe
PID 1360 wrote to memory of 556	1360	wtava.bin.exe	wmic.exe
PID 1360 wrote to memory of 556	1360	wtava.bin.exe	wmic.exe
PID 1360 wrote to memory of 556	1360	wtava.bin.exe	wmic.exe
PID 1360 wrote to memory of 532	1360	wtava.bin.exe	vssadmin.exe
PID 1360 wrote to memory of 532	1360	wtava.bin.exe	vssadmin.exe
PID 1360 wrote to memory of 532	1360	wtava.bin.exe	vssadmin.exe
PID 1360 wrote to memory of 532	1360	wtava.bin.exe	vssadmin.exe
PID 1360 wrote to memory of 1608	1360	wtava.bin.exe	wmic.exe
PID 1360 wrote to memory of 1608	1360	wtava.bin.exe	wmic.exe
PID 1360 wrote to memory of 1608	1360	wtava.bin.exe	wmic.exe
PID 1360 wrote to memory of 1608	1360	wtava.bin.exe	wmic.exe
PID 1360 wrote to memory of 1544	1360	wtava.bin.exe	vssadmin.exe
PID 1360 wrote to memory of 1544	1360	wtava.bin.exe	vssadmin.exe
PID 1360 wrote to memory of 1544	1360	wtava.bin.exe	vssadmin.exe
PID 1360 wrote to memory of 1544	1360	wtava.bin.exe	vssadmin.exe
PID 1756 wrote to memory of 1220	1756	taskeng.exe	wtava.bin.exe
PID 1756 wrote to memory of 1220	1756	taskeng.exe	wtava.bin.exe
PID 1756 wrote to memory of 1220	1756	taskeng.exe	wtava.bin.exe
PID 1756 wrote to memory of 1220	1756	taskeng.exe	wtava.bin.exe

C:\Users\Admin\AppData\Local\Temp\wtava.bin.exe
"C:\Users\Admin\AppData\Local\Temp\wtava.bin.exe"
1⤵
- UAC bypass
- Drops desktop.ini file(s)
- System policy modification
- Suspicious behavior: EnumeratesProcesses
- Checks whether UAC is enabled
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
PID:1360

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic.exe SHADOWCOPY /nointeractive
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1384

C:\Windows\SysWOW64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
2⤵
- Interacts with shadow copies
PID:1780

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic.exe SHADOWCOPY /nointeractive
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:556

C:\Windows\SysWOW64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
2⤵
- Interacts with shadow copies
PID:532

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic.exe SHADOWCOPY /nointeractive
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1608

C:\Windows\SysWOW64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
2⤵
- Interacts with shadow copies
PID:1544

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:520

C:\Windows\system32\taskeng.exe
taskeng.exe {B12733F5-976A-4003-8437-88E417CC6F4C} S-1-5-21-910373003-3952921535-3480519689-1000:DJRWGDLZ\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1756