Analysis
-
max time kernel
130s -
max time network
168s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
13-05-2021 02:34
Static task
static1
Behavioral task
behavioral1
Sample
f886202f15a93ff1bd3522be14dd3143c4f7443cc700c7840fe8667e8abf4656.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
f886202f15a93ff1bd3522be14dd3143c4f7443cc700c7840fe8667e8abf4656.exe
-
Size
134KB
-
MD5
9a4c58c9a89a06da19007a28186d454a
-
SHA1
0e0e436266e1dc0bde5ea0bd7a0421f17d483dc0
-
SHA256
f886202f15a93ff1bd3522be14dd3143c4f7443cc700c7840fe8667e8abf4656
-
SHA512
25595c1bbdb2d1a42f48d53e86e7b854f7ac90df31b392d71c618e29811158589dd83469833055afc00b972d0df7850fd1d0b0f317b381f75b669761019262ba
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
cloudimpl.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat cloudimpl.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
cloudimpl.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings cloudimpl.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 cloudimpl.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07000d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 cloudimpl.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7} cloudimpl.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionReason = "1" cloudimpl.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = 007a13d80248d701 cloudimpl.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-2c-ab-76-63-f3\WpadDecisionReason = "1" cloudimpl.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix cloudimpl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad cloudimpl.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-2c-ab-76-63-f3 cloudimpl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections cloudimpl.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" cloudimpl.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" cloudimpl.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecision = "0" cloudimpl.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\5a-2c-ab-76-63-f3 cloudimpl.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-2c-ab-76-63-f3\WpadDecisionTime = 007a13d80248d701 cloudimpl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings cloudimpl.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" cloudimpl.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 cloudimpl.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadNetworkName = "Network" cloudimpl.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-2c-ab-76-63-f3\WpadDecision = "0" cloudimpl.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
cloudimpl.exepid process 660 cloudimpl.exe 660 cloudimpl.exe 660 cloudimpl.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
f886202f15a93ff1bd3522be14dd3143c4f7443cc700c7840fe8667e8abf4656.exepid process 1992 f886202f15a93ff1bd3522be14dd3143c4f7443cc700c7840fe8667e8abf4656.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
f886202f15a93ff1bd3522be14dd3143c4f7443cc700c7840fe8667e8abf4656.exef886202f15a93ff1bd3522be14dd3143c4f7443cc700c7840fe8667e8abf4656.execloudimpl.execloudimpl.exepid process 1208 f886202f15a93ff1bd3522be14dd3143c4f7443cc700c7840fe8667e8abf4656.exe 1992 f886202f15a93ff1bd3522be14dd3143c4f7443cc700c7840fe8667e8abf4656.exe 332 cloudimpl.exe 660 cloudimpl.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
f886202f15a93ff1bd3522be14dd3143c4f7443cc700c7840fe8667e8abf4656.execloudimpl.exedescription pid process target process PID 1208 wrote to memory of 1992 1208 f886202f15a93ff1bd3522be14dd3143c4f7443cc700c7840fe8667e8abf4656.exe f886202f15a93ff1bd3522be14dd3143c4f7443cc700c7840fe8667e8abf4656.exe PID 1208 wrote to memory of 1992 1208 f886202f15a93ff1bd3522be14dd3143c4f7443cc700c7840fe8667e8abf4656.exe f886202f15a93ff1bd3522be14dd3143c4f7443cc700c7840fe8667e8abf4656.exe PID 1208 wrote to memory of 1992 1208 f886202f15a93ff1bd3522be14dd3143c4f7443cc700c7840fe8667e8abf4656.exe f886202f15a93ff1bd3522be14dd3143c4f7443cc700c7840fe8667e8abf4656.exe PID 1208 wrote to memory of 1992 1208 f886202f15a93ff1bd3522be14dd3143c4f7443cc700c7840fe8667e8abf4656.exe f886202f15a93ff1bd3522be14dd3143c4f7443cc700c7840fe8667e8abf4656.exe PID 332 wrote to memory of 660 332 cloudimpl.exe cloudimpl.exe PID 332 wrote to memory of 660 332 cloudimpl.exe cloudimpl.exe PID 332 wrote to memory of 660 332 cloudimpl.exe cloudimpl.exe PID 332 wrote to memory of 660 332 cloudimpl.exe cloudimpl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f886202f15a93ff1bd3522be14dd3143c4f7443cc700c7840fe8667e8abf4656.exe"C:\Users\Admin\AppData\Local\Temp\f886202f15a93ff1bd3522be14dd3143c4f7443cc700c7840fe8667e8abf4656.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\f886202f15a93ff1bd3522be14dd3143c4f7443cc700c7840fe8667e8abf4656.exe--e5d549442⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:1992
-
C:\Windows\SysWOW64\cloudimpl.exe"C:\Windows\SysWOW64\cloudimpl.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Windows\SysWOW64\cloudimpl.exe--b902f40b2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:660
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/660-68-0x0000000000000000-mapping.dmp
-
memory/1208-60-0x0000000075C71000-0x0000000075C73000-memory.dmpFilesize
8KB
-
memory/1208-63-0x0000000000220000-0x0000000000231000-memory.dmpFilesize
68KB
-
memory/1208-65-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/1992-61-0x0000000000000000-mapping.dmp
-
memory/1992-66-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB