Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
13-05-2021 01:59
Static task
static1
Behavioral task
behavioral1
Sample
84fecc89d0e95d9fab6a35ad6fc2a39242d756fa85c8e6cb7fba4da84feb077a.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
84fecc89d0e95d9fab6a35ad6fc2a39242d756fa85c8e6cb7fba4da84feb077a.exe
-
Size
149KB
-
MD5
171737287ba86c79b03985c56b621c15
-
SHA1
d5dd66318e054ad25f87676d5e72253abbdae1cc
-
SHA256
84fecc89d0e95d9fab6a35ad6fc2a39242d756fa85c8e6cb7fba4da84feb077a
-
SHA512
fac8d38a25492b74716d7cf052d7af178bfe0f98de6d794b09511a88d5eb31e3a825adabf0142589ef953ec278da35c9b08b77823273a4eb2335ed61e536d790
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
bearsglue.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat bearsglue.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
bearsglue.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 bearsglue.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings bearsglue.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionReason = "1" bearsglue.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77 bearsglue.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings bearsglue.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections bearsglue.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32} bearsglue.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecision = "0" bearsglue.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\32-e2-17-db-d2-77 bearsglue.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1" bearsglue.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" bearsglue.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" bearsglue.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070025000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 bearsglue.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionTime = c0be766ba247d701 bearsglue.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadNetworkName = "Network" bearsglue.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = c0be766ba247d701 bearsglue.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0" bearsglue.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix bearsglue.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 bearsglue.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" bearsglue.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad bearsglue.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
bearsglue.exepid process 1564 bearsglue.exe 1564 bearsglue.exe 1564 bearsglue.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
84fecc89d0e95d9fab6a35ad6fc2a39242d756fa85c8e6cb7fba4da84feb077a.exepid process 1712 84fecc89d0e95d9fab6a35ad6fc2a39242d756fa85c8e6cb7fba4da84feb077a.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
84fecc89d0e95d9fab6a35ad6fc2a39242d756fa85c8e6cb7fba4da84feb077a.exe84fecc89d0e95d9fab6a35ad6fc2a39242d756fa85c8e6cb7fba4da84feb077a.exebearsglue.exebearsglue.exepid process 1072 84fecc89d0e95d9fab6a35ad6fc2a39242d756fa85c8e6cb7fba4da84feb077a.exe 1712 84fecc89d0e95d9fab6a35ad6fc2a39242d756fa85c8e6cb7fba4da84feb077a.exe 316 bearsglue.exe 1564 bearsglue.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
84fecc89d0e95d9fab6a35ad6fc2a39242d756fa85c8e6cb7fba4da84feb077a.exebearsglue.exedescription pid process target process PID 1072 wrote to memory of 1712 1072 84fecc89d0e95d9fab6a35ad6fc2a39242d756fa85c8e6cb7fba4da84feb077a.exe 84fecc89d0e95d9fab6a35ad6fc2a39242d756fa85c8e6cb7fba4da84feb077a.exe PID 1072 wrote to memory of 1712 1072 84fecc89d0e95d9fab6a35ad6fc2a39242d756fa85c8e6cb7fba4da84feb077a.exe 84fecc89d0e95d9fab6a35ad6fc2a39242d756fa85c8e6cb7fba4da84feb077a.exe PID 1072 wrote to memory of 1712 1072 84fecc89d0e95d9fab6a35ad6fc2a39242d756fa85c8e6cb7fba4da84feb077a.exe 84fecc89d0e95d9fab6a35ad6fc2a39242d756fa85c8e6cb7fba4da84feb077a.exe PID 1072 wrote to memory of 1712 1072 84fecc89d0e95d9fab6a35ad6fc2a39242d756fa85c8e6cb7fba4da84feb077a.exe 84fecc89d0e95d9fab6a35ad6fc2a39242d756fa85c8e6cb7fba4da84feb077a.exe PID 316 wrote to memory of 1564 316 bearsglue.exe bearsglue.exe PID 316 wrote to memory of 1564 316 bearsglue.exe bearsglue.exe PID 316 wrote to memory of 1564 316 bearsglue.exe bearsglue.exe PID 316 wrote to memory of 1564 316 bearsglue.exe bearsglue.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\84fecc89d0e95d9fab6a35ad6fc2a39242d756fa85c8e6cb7fba4da84feb077a.exe"C:\Users\Admin\AppData\Local\Temp\84fecc89d0e95d9fab6a35ad6fc2a39242d756fa85c8e6cb7fba4da84feb077a.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\84fecc89d0e95d9fab6a35ad6fc2a39242d756fa85c8e6cb7fba4da84feb077a.exe--c008463b2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:1712
-
C:\Windows\SysWOW64\bearsglue.exe"C:\Windows\SysWOW64\bearsglue.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Windows\SysWOW64\bearsglue.exe--b5f56d4a2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1564
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/316-67-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1072-60-0x0000000000220000-0x0000000000231000-memory.dmpFilesize
68KB
-
memory/1072-62-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1564-68-0x0000000000000000-mapping.dmp
-
memory/1712-61-0x0000000000000000-mapping.dmp
-
memory/1712-65-0x0000000075411000-0x0000000075413000-memory.dmpFilesize
8KB