Analysis
-
max time kernel
125s -
max time network
143s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
15-05-2021 12:36
Static task
static1
Behavioral task
behavioral1
Sample
a52cbf48bd3feec28384bc758c408e5b849f5a08ac7e680542940bfdb4e3e410.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
a52cbf48bd3feec28384bc758c408e5b849f5a08ac7e680542940bfdb4e3e410.exe
-
Size
136KB
-
MD5
47007e2eea421603c3b5161dbcaaaf80
-
SHA1
24a08f15f4527df9e801ea16646c8121cc5e80d3
-
SHA256
a52cbf48bd3feec28384bc758c408e5b849f5a08ac7e680542940bfdb4e3e410
-
SHA512
e61bf0f5fcfac30e0c52263b7afc9ef56bc65e6e1685091d49b1548db7f19d5704c5d715b9d57b607bb9bba543ff46e0c74bb2db75e851e8ab13c3aa00fff740
Malware Config
Signatures
-
Drops file in System32 directory 5 IoCs
Processes:
commentpinned.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat commentpinned.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 commentpinned.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE commentpinned.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies commentpinned.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 commentpinned.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 3 IoCs
Processes:
commentpinned.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" commentpinned.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" commentpinned.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix commentpinned.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
commentpinned.exepid process 1524 commentpinned.exe 1524 commentpinned.exe 1524 commentpinned.exe 1524 commentpinned.exe 1524 commentpinned.exe 1524 commentpinned.exe 1524 commentpinned.exe 1524 commentpinned.exe 1524 commentpinned.exe 1524 commentpinned.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
a52cbf48bd3feec28384bc758c408e5b849f5a08ac7e680542940bfdb4e3e410.exepid process 2256 a52cbf48bd3feec28384bc758c408e5b849f5a08ac7e680542940bfdb4e3e410.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
a52cbf48bd3feec28384bc758c408e5b849f5a08ac7e680542940bfdb4e3e410.execommentpinned.exedescription pid process target process PID 2988 wrote to memory of 2256 2988 a52cbf48bd3feec28384bc758c408e5b849f5a08ac7e680542940bfdb4e3e410.exe a52cbf48bd3feec28384bc758c408e5b849f5a08ac7e680542940bfdb4e3e410.exe PID 2988 wrote to memory of 2256 2988 a52cbf48bd3feec28384bc758c408e5b849f5a08ac7e680542940bfdb4e3e410.exe a52cbf48bd3feec28384bc758c408e5b849f5a08ac7e680542940bfdb4e3e410.exe PID 2988 wrote to memory of 2256 2988 a52cbf48bd3feec28384bc758c408e5b849f5a08ac7e680542940bfdb4e3e410.exe a52cbf48bd3feec28384bc758c408e5b849f5a08ac7e680542940bfdb4e3e410.exe PID 2776 wrote to memory of 1524 2776 commentpinned.exe commentpinned.exe PID 2776 wrote to memory of 1524 2776 commentpinned.exe commentpinned.exe PID 2776 wrote to memory of 1524 2776 commentpinned.exe commentpinned.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a52cbf48bd3feec28384bc758c408e5b849f5a08ac7e680542940bfdb4e3e410.exe"C:\Users\Admin\AppData\Local\Temp\a52cbf48bd3feec28384bc758c408e5b849f5a08ac7e680542940bfdb4e3e410.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\a52cbf48bd3feec28384bc758c408e5b849f5a08ac7e680542940bfdb4e3e410.exe--425290772⤵
- Suspicious behavior: RenamesItself
PID:2256
-
C:\Windows\SysWOW64\commentpinned.exe"C:\Windows\SysWOW64\commentpinned.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\commentpinned.exe--742b4a4d2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1524
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1524-119-0x0000000000000000-mapping.dmp
-
memory/1524-122-0x0000000000430000-0x00000000004DE000-memory.dmpFilesize
696KB
-
memory/2256-115-0x0000000000000000-mapping.dmp
-
memory/2256-117-0x0000000000430000-0x00000000004DE000-memory.dmpFilesize
696KB
-
memory/2256-118-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2776-121-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2776-120-0x0000000000430000-0x00000000004DE000-memory.dmpFilesize
696KB
-
memory/2988-114-0x00000000007B0000-0x00000000007C5000-memory.dmpFilesize
84KB
-
memory/2988-116-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB