Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
07-04-2021 13:08
Static task
static1
Behavioral task
behavioral1
Sample
22d7305553fb73065b56e2fcaeb399653a8a79bb7104a9e8ce44c5f7534a4b3b.exe
Resource
win7v20201028
General
-
Target
22d7305553fb73065b56e2fcaeb399653a8a79bb7104a9e8ce44c5f7534a4b3b.exe
-
Size
572KB
-
MD5
6394ab67821651c32b6778a2a79bda66
-
SHA1
d9083e0f56cf231aaa22044d28829e94e464b7d2
-
SHA256
22d7305553fb73065b56e2fcaeb399653a8a79bb7104a9e8ce44c5f7534a4b3b
-
SHA512
dff9db981012d5e930fd24d544524be84ee4df11a36dbda5f276ca7bc95af2ce994730dad23b11905aa6be965cacd65733fb6b4ae6cdbf0a7bb69e2b31ed2540
Malware Config
Extracted
emotet
Epoch2
212.186.191.177:80
91.242.138.5:80
173.13.135.102:80
59.110.18.236:443
45.56.88.91:443
51.68.220.244:8080
206.81.10.215:8080
80.11.163.139:21
182.176.132.213:8090
165.227.156.155:443
118.201.230.249:80
138.201.140.110:8080
46.105.131.87:80
87.106.139.101:8080
24.45.193.161:7080
209.97.168.52:8080
190.12.119.180:443
190.147.215.53:22
191.92.209.110:7080
91.205.215.66:8080
190.211.207.11:443
186.75.241.230:80
173.212.203.26:8080
67.225.179.64:8080
31.12.67.62:7080
128.65.154.183:443
189.209.217.49:80
107.2.2.28:80
167.99.105.223:7080
12.229.155.122:80
104.236.246.93:8080
178.209.71.63:8080
212.129.24.79:8080
95.128.43.213:8080
178.210.51.222:8080
5.88.182.250:80
91.231.166.126:8080
176.31.200.130:8080
192.81.213.192:8080
103.39.131.88:80
164.68.101.171:80
201.184.105.242:443
213.179.105.214:8080
149.202.153.252:8080
47.50.251.130:80
93.147.141.5:80
37.157.194.134:443
181.57.193.14:80
45.33.49.124:443
192.241.255.77:8080
62.75.187.192:8080
31.31.77.83:443
181.143.194.138:443
144.139.247.220:80
181.31.213.158:8080
183.102.238.69:465
206.189.112.148:8080
165.228.24.197:80
59.103.164.174:80
83.136.245.190:8080
107.170.24.125:8080
50.116.86.205:8080
197.254.221.174:80
190.108.228.48:990
104.131.11.150:8080
200.71.148.138:8080
120.150.246.241:80
217.160.182.191:8080
159.65.25.128:8080
167.114.242.226:8080
190.226.44.20:21
92.222.216.44:8080
85.104.59.244:20
101.187.247.29:80
169.239.182.217:8080
104.131.44.150:8080
192.241.220.155:8080
91.73.197.90:80
190.145.67.134:8090
116.48.142.21:443
5.196.74.210:8080
87.230.19.21:8080
211.63.71.72:8080
167.71.10.37:8080
195.244.215.206:80
190.53.135.159:21
80.21.182.46:80
78.24.219.147:8080
31.172.240.91:8080
87.106.136.232:8080
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
chunkerwsat.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat chunkerwsat.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 25 IoCs
Processes:
chunkerwsat.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 303d12f1af2bd701 chunkerwsat.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings chunkerwsat.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" chunkerwsat.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad chunkerwsat.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD} chunkerwsat.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\32-e2-17-db-d2-77 chunkerwsat.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0" chunkerwsat.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections chunkerwsat.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 chunkerwsat.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecision = "0" chunkerwsat.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadNetworkName = "Network" chunkerwsat.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070045000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 chunkerwsat.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecisionTime = f0c317b4af2bd701 chunkerwsat.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1" chunkerwsat.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDetectedUrl chunkerwsat.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix chunkerwsat.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" chunkerwsat.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" chunkerwsat.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 chunkerwsat.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070045000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 chunkerwsat.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecisionTime = 303d12f1af2bd701 chunkerwsat.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings chunkerwsat.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecisionReason = "1" chunkerwsat.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77 chunkerwsat.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = f0c317b4af2bd701 chunkerwsat.exe -
Suspicious behavior: EmotetMutantsSpam 2 IoCs
Processes:
22d7305553fb73065b56e2fcaeb399653a8a79bb7104a9e8ce44c5f7534a4b3b.exechunkerwsat.exepid process 1960 22d7305553fb73065b56e2fcaeb399653a8a79bb7104a9e8ce44c5f7534a4b3b.exe 1384 chunkerwsat.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chunkerwsat.exepid process 1384 chunkerwsat.exe 1384 chunkerwsat.exe 1384 chunkerwsat.exe 1384 chunkerwsat.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
22d7305553fb73065b56e2fcaeb399653a8a79bb7104a9e8ce44c5f7534a4b3b.exepid process 1960 22d7305553fb73065b56e2fcaeb399653a8a79bb7104a9e8ce44c5f7534a4b3b.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
22d7305553fb73065b56e2fcaeb399653a8a79bb7104a9e8ce44c5f7534a4b3b.exe22d7305553fb73065b56e2fcaeb399653a8a79bb7104a9e8ce44c5f7534a4b3b.exechunkerwsat.exechunkerwsat.exepid process 744 22d7305553fb73065b56e2fcaeb399653a8a79bb7104a9e8ce44c5f7534a4b3b.exe 1960 22d7305553fb73065b56e2fcaeb399653a8a79bb7104a9e8ce44c5f7534a4b3b.exe 920 chunkerwsat.exe 1384 chunkerwsat.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
22d7305553fb73065b56e2fcaeb399653a8a79bb7104a9e8ce44c5f7534a4b3b.exechunkerwsat.exedescription pid process target process PID 744 wrote to memory of 1960 744 22d7305553fb73065b56e2fcaeb399653a8a79bb7104a9e8ce44c5f7534a4b3b.exe 22d7305553fb73065b56e2fcaeb399653a8a79bb7104a9e8ce44c5f7534a4b3b.exe PID 744 wrote to memory of 1960 744 22d7305553fb73065b56e2fcaeb399653a8a79bb7104a9e8ce44c5f7534a4b3b.exe 22d7305553fb73065b56e2fcaeb399653a8a79bb7104a9e8ce44c5f7534a4b3b.exe PID 744 wrote to memory of 1960 744 22d7305553fb73065b56e2fcaeb399653a8a79bb7104a9e8ce44c5f7534a4b3b.exe 22d7305553fb73065b56e2fcaeb399653a8a79bb7104a9e8ce44c5f7534a4b3b.exe PID 744 wrote to memory of 1960 744 22d7305553fb73065b56e2fcaeb399653a8a79bb7104a9e8ce44c5f7534a4b3b.exe 22d7305553fb73065b56e2fcaeb399653a8a79bb7104a9e8ce44c5f7534a4b3b.exe PID 920 wrote to memory of 1384 920 chunkerwsat.exe chunkerwsat.exe PID 920 wrote to memory of 1384 920 chunkerwsat.exe chunkerwsat.exe PID 920 wrote to memory of 1384 920 chunkerwsat.exe chunkerwsat.exe PID 920 wrote to memory of 1384 920 chunkerwsat.exe chunkerwsat.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\22d7305553fb73065b56e2fcaeb399653a8a79bb7104a9e8ce44c5f7534a4b3b.exe"C:\Users\Admin\AppData\Local\Temp\22d7305553fb73065b56e2fcaeb399653a8a79bb7104a9e8ce44c5f7534a4b3b.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\22d7305553fb73065b56e2fcaeb399653a8a79bb7104a9e8ce44c5f7534a4b3b.exe--f584da8b2⤵
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\chunkerwsat.exe"C:\Windows\SysWOW64\chunkerwsat.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chunkerwsat.exe--95cf20ff2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EmotetMutantsSpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/744-2-0x0000000075E51000-0x0000000075E53000-memory.dmpFilesize
8KB
-
memory/744-3-0x00000000003A0000-0x00000000003B7000-memory.dmpFilesize
92KB
-
memory/744-6-0x0000000000270000-0x0000000000281000-memory.dmpFilesize
68KB
-
memory/920-11-0x00000000004A0000-0x00000000004B7000-memory.dmpFilesize
92KB
-
memory/1384-12-0x0000000000000000-mapping.dmp
-
memory/1384-15-0x00000000002B0000-0x00000000002C7000-memory.dmpFilesize
92KB
-
memory/1384-16-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/1960-4-0x0000000000000000-mapping.dmp
-
memory/1960-7-0x0000000000360000-0x0000000000377000-memory.dmpFilesize
92KB
-
memory/1960-8-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB