Analysis
-
max time kernel
136s -
max time network
145s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
16-05-2021 05:28
Static task
static1
Behavioral task
behavioral1
Sample
be1642aa490e9fa2baad0336321170417cb3780bdf54c217e405970479454b38.exe
Resource
win7v20210410
0 signatures
0 seconds
General
-
Target
be1642aa490e9fa2baad0336321170417cb3780bdf54c217e405970479454b38.exe
-
Size
149KB
-
MD5
55030747a97cad66aff2d3334cdd3c8c
-
SHA1
7a04531b784b8634994fbcb0ac03329db70cbe0c
-
SHA256
be1642aa490e9fa2baad0336321170417cb3780bdf54c217e405970479454b38
-
SHA512
7dacc6dc6433a35aebe06a1db61c709329e23353238ab6f91cec2d53e7d27c4de7698d89a4a08cf336079470357327a4e999f57754ebb1412d4bf6984b6e34ae
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
titleser.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat titleser.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
titleser.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecision = "0" titleser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\32-e2-17-db-d2-77 titleser.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix titleser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad titleser.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionTime = 40b3626b994ad701 titleser.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07000d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 titleser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32} titleser.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1" titleser.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0" titleser.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings titleser.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 titleser.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" titleser.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadNetworkName = "Network" titleser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections titleser.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" titleser.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 titleser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77 titleser.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 40b3626b994ad701 titleser.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" titleser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings titleser.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionReason = "1" titleser.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
titleser.exepid process 904 titleser.exe 904 titleser.exe 904 titleser.exe 904 titleser.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
be1642aa490e9fa2baad0336321170417cb3780bdf54c217e405970479454b38.exepid process 1368 be1642aa490e9fa2baad0336321170417cb3780bdf54c217e405970479454b38.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
be1642aa490e9fa2baad0336321170417cb3780bdf54c217e405970479454b38.exebe1642aa490e9fa2baad0336321170417cb3780bdf54c217e405970479454b38.exetitleser.exetitleser.exepid process 1200 be1642aa490e9fa2baad0336321170417cb3780bdf54c217e405970479454b38.exe 1368 be1642aa490e9fa2baad0336321170417cb3780bdf54c217e405970479454b38.exe 336 titleser.exe 904 titleser.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
be1642aa490e9fa2baad0336321170417cb3780bdf54c217e405970479454b38.exetitleser.exedescription pid process target process PID 1200 wrote to memory of 1368 1200 be1642aa490e9fa2baad0336321170417cb3780bdf54c217e405970479454b38.exe be1642aa490e9fa2baad0336321170417cb3780bdf54c217e405970479454b38.exe PID 1200 wrote to memory of 1368 1200 be1642aa490e9fa2baad0336321170417cb3780bdf54c217e405970479454b38.exe be1642aa490e9fa2baad0336321170417cb3780bdf54c217e405970479454b38.exe PID 1200 wrote to memory of 1368 1200 be1642aa490e9fa2baad0336321170417cb3780bdf54c217e405970479454b38.exe be1642aa490e9fa2baad0336321170417cb3780bdf54c217e405970479454b38.exe PID 1200 wrote to memory of 1368 1200 be1642aa490e9fa2baad0336321170417cb3780bdf54c217e405970479454b38.exe be1642aa490e9fa2baad0336321170417cb3780bdf54c217e405970479454b38.exe PID 336 wrote to memory of 904 336 titleser.exe titleser.exe PID 336 wrote to memory of 904 336 titleser.exe titleser.exe PID 336 wrote to memory of 904 336 titleser.exe titleser.exe PID 336 wrote to memory of 904 336 titleser.exe titleser.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\be1642aa490e9fa2baad0336321170417cb3780bdf54c217e405970479454b38.exe"C:\Users\Admin\AppData\Local\Temp\be1642aa490e9fa2baad0336321170417cb3780bdf54c217e405970479454b38.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\be1642aa490e9fa2baad0336321170417cb3780bdf54c217e405970479454b38.exe--fc1cee912⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\titleser.exe"C:\Windows\SysWOW64\titleser.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\titleser.exe--5f52b81a2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/904-66-0x0000000000000000-mapping.dmp
-
memory/1200-59-0x0000000000220000-0x0000000000231000-memory.dmpFilesize
68KB
-
memory/1200-61-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1368-60-0x0000000000000000-mapping.dmp
-
memory/1368-64-0x00000000768B1000-0x00000000768B3000-memory.dmpFilesize
8KB