Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
16-05-2021 04:46
Static task
static1
Behavioral task
behavioral1
Sample
d80b4a5441fb29a2cb45d437423d84ded8b3d57dff7bb884ab501acf11fe71c0.exe
Resource
win7v20210410
0 signatures
0 seconds
General
-
Target
d80b4a5441fb29a2cb45d437423d84ded8b3d57dff7bb884ab501acf11fe71c0.exe
-
Size
89KB
-
MD5
d39a5f8dfa267d2adea6072d3f62866e
-
SHA1
57be36026bff62b04c93acfe92f9b24544b37539
-
SHA256
d80b4a5441fb29a2cb45d437423d84ded8b3d57dff7bb884ab501acf11fe71c0
-
SHA512
ec14657dc3dd9714b64e2cbf381e3b9eaec0f7649f6da0e8079d42dc9521dbb53ff75d66d8033f311ef18a8282f7b93ae8c32a0aaf77d90f3e675161ba3dc3dd
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
ipropportal.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat ipropportal.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
ipropportal.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070029000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ipropportal.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77 ipropportal.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\32-e2-17-db-d2-77 ipropportal.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = b0176ee5904ad701 ipropportal.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections ipropportal.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings ipropportal.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" ipropportal.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32} ipropportal.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecision = "0" ipropportal.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadNetworkName = "Network" ipropportal.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix ipropportal.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" ipropportal.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionTime = b0176ee5904ad701 ipropportal.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0" ipropportal.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" ipropportal.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionReason = "1" ipropportal.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ipropportal.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad ipropportal.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1" ipropportal.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings ipropportal.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ipropportal.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
ipropportal.exepid process 1668 ipropportal.exe 1668 ipropportal.exe 1668 ipropportal.exe 1668 ipropportal.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
d80b4a5441fb29a2cb45d437423d84ded8b3d57dff7bb884ab501acf11fe71c0.exepid process 2036 d80b4a5441fb29a2cb45d437423d84ded8b3d57dff7bb884ab501acf11fe71c0.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
d80b4a5441fb29a2cb45d437423d84ded8b3d57dff7bb884ab501acf11fe71c0.exeipropportal.exedescription pid process target process PID 1208 wrote to memory of 2036 1208 d80b4a5441fb29a2cb45d437423d84ded8b3d57dff7bb884ab501acf11fe71c0.exe d80b4a5441fb29a2cb45d437423d84ded8b3d57dff7bb884ab501acf11fe71c0.exe PID 1208 wrote to memory of 2036 1208 d80b4a5441fb29a2cb45d437423d84ded8b3d57dff7bb884ab501acf11fe71c0.exe d80b4a5441fb29a2cb45d437423d84ded8b3d57dff7bb884ab501acf11fe71c0.exe PID 1208 wrote to memory of 2036 1208 d80b4a5441fb29a2cb45d437423d84ded8b3d57dff7bb884ab501acf11fe71c0.exe d80b4a5441fb29a2cb45d437423d84ded8b3d57dff7bb884ab501acf11fe71c0.exe PID 1208 wrote to memory of 2036 1208 d80b4a5441fb29a2cb45d437423d84ded8b3d57dff7bb884ab501acf11fe71c0.exe d80b4a5441fb29a2cb45d437423d84ded8b3d57dff7bb884ab501acf11fe71c0.exe PID 1520 wrote to memory of 1668 1520 ipropportal.exe ipropportal.exe PID 1520 wrote to memory of 1668 1520 ipropportal.exe ipropportal.exe PID 1520 wrote to memory of 1668 1520 ipropportal.exe ipropportal.exe PID 1520 wrote to memory of 1668 1520 ipropportal.exe ipropportal.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d80b4a5441fb29a2cb45d437423d84ded8b3d57dff7bb884ab501acf11fe71c0.exe"C:\Users\Admin\AppData\Local\Temp\d80b4a5441fb29a2cb45d437423d84ded8b3d57dff7bb884ab501acf11fe71c0.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d80b4a5441fb29a2cb45d437423d84ded8b3d57dff7bb884ab501acf11fe71c0.exe--8152a55c2⤵
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\ipropportal.exe"C:\Windows\SysWOW64\ipropportal.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipropportal.exe--63da21ae2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1208-59-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/1208-60-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1208-63-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/1668-68-0x0000000000000000-mapping.dmp
-
memory/2036-61-0x0000000000000000-mapping.dmp
-
memory/2036-66-0x0000000075561000-0x0000000075563000-memory.dmpFilesize
8KB