Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
07-04-2021 15:27
Static task
static1
Behavioral task
behavioral1
Sample
faca543878c17e6a54140eb3307d5f9c948fe517b74fb731413af4fe39a163c5.exe
Resource
win7v20201028
General
-
Target
faca543878c17e6a54140eb3307d5f9c948fe517b74fb731413af4fe39a163c5.exe
-
Size
572KB
-
MD5
2c4e3add87c219ec974b2ebc2551307f
-
SHA1
51d0f3d119718b236c2afc964df6ea43d80d1988
-
SHA256
faca543878c17e6a54140eb3307d5f9c948fe517b74fb731413af4fe39a163c5
-
SHA512
a79f1e125ecd0a7f721fb19e8e4ef713f62031e91ab3e59aefb136ba6002477569d685491b8af2b1002a1fa455133541336188262498b2bb5b9106be8385791c
Malware Config
Signatures
-
Drops file in System32 directory 5 IoCs
Processes:
ipmimailbox.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat ipmimailbox.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 ipmimailbox.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE ipmimailbox.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies ipmimailbox.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 ipmimailbox.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 3 IoCs
Processes:
ipmimailbox.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" ipmimailbox.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" ipmimailbox.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix ipmimailbox.exe -
Suspicious behavior: EmotetMutantsSpam 2 IoCs
Processes:
faca543878c17e6a54140eb3307d5f9c948fe517b74fb731413af4fe39a163c5.exeipmimailbox.exepid process 3792 faca543878c17e6a54140eb3307d5f9c948fe517b74fb731413af4fe39a163c5.exe 3824 ipmimailbox.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
ipmimailbox.exepid process 3824 ipmimailbox.exe 3824 ipmimailbox.exe 3824 ipmimailbox.exe 3824 ipmimailbox.exe 3824 ipmimailbox.exe 3824 ipmimailbox.exe 3824 ipmimailbox.exe 3824 ipmimailbox.exe 3824 ipmimailbox.exe 3824 ipmimailbox.exe 3824 ipmimailbox.exe 3824 ipmimailbox.exe 3824 ipmimailbox.exe 3824 ipmimailbox.exe 3824 ipmimailbox.exe 3824 ipmimailbox.exe 3824 ipmimailbox.exe 3824 ipmimailbox.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
faca543878c17e6a54140eb3307d5f9c948fe517b74fb731413af4fe39a163c5.exepid process 3792 faca543878c17e6a54140eb3307d5f9c948fe517b74fb731413af4fe39a163c5.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
faca543878c17e6a54140eb3307d5f9c948fe517b74fb731413af4fe39a163c5.exefaca543878c17e6a54140eb3307d5f9c948fe517b74fb731413af4fe39a163c5.exeipmimailbox.exeipmimailbox.exepid process 3996 faca543878c17e6a54140eb3307d5f9c948fe517b74fb731413af4fe39a163c5.exe 3792 faca543878c17e6a54140eb3307d5f9c948fe517b74fb731413af4fe39a163c5.exe 3160 ipmimailbox.exe 3824 ipmimailbox.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
faca543878c17e6a54140eb3307d5f9c948fe517b74fb731413af4fe39a163c5.exeipmimailbox.exedescription pid process target process PID 3996 wrote to memory of 3792 3996 faca543878c17e6a54140eb3307d5f9c948fe517b74fb731413af4fe39a163c5.exe faca543878c17e6a54140eb3307d5f9c948fe517b74fb731413af4fe39a163c5.exe PID 3996 wrote to memory of 3792 3996 faca543878c17e6a54140eb3307d5f9c948fe517b74fb731413af4fe39a163c5.exe faca543878c17e6a54140eb3307d5f9c948fe517b74fb731413af4fe39a163c5.exe PID 3996 wrote to memory of 3792 3996 faca543878c17e6a54140eb3307d5f9c948fe517b74fb731413af4fe39a163c5.exe faca543878c17e6a54140eb3307d5f9c948fe517b74fb731413af4fe39a163c5.exe PID 3160 wrote to memory of 3824 3160 ipmimailbox.exe ipmimailbox.exe PID 3160 wrote to memory of 3824 3160 ipmimailbox.exe ipmimailbox.exe PID 3160 wrote to memory of 3824 3160 ipmimailbox.exe ipmimailbox.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\faca543878c17e6a54140eb3307d5f9c948fe517b74fb731413af4fe39a163c5.exe"C:\Users\Admin\AppData\Local\Temp\faca543878c17e6a54140eb3307d5f9c948fe517b74fb731413af4fe39a163c5.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\faca543878c17e6a54140eb3307d5f9c948fe517b74fb731413af4fe39a163c5.exe--3c8a43ec2⤵
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\ipmimailbox.exe"C:\Windows\SysWOW64\ipmimailbox.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipmimailbox.exe--1024b7e72⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\b36208c2e0ba1c7f0e7f094499ea3452_72727c5d-8d0e-47bb-8579-8067735277ffMD5
d854e5bf32f6eff669679c3a9acd847a
SHA10d43be3bd4161a1cbb329c910fdf62346fa45b20
SHA2565a08f974f0f6e267fb0a7658b1d80e809a3f4f1293a9149238b647f3ed305660
SHA5122dafe095dadaf0536ab48043a05b71900717e49c6a344e3fcd4fa1282db0a46559e67528d541195efaafc77e53d2e69cbe6da46f4ce0fcf827f9d94c4bb48259
-
memory/3792-2-0x0000000000000000-mapping.dmp
-
memory/3792-4-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/3824-6-0x0000000000000000-mapping.dmp
-
memory/3824-9-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/3996-3-0x0000000000620000-0x0000000000631000-memory.dmpFilesize
68KB