Analysis
-
max time kernel
133s -
max time network
169s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
16-05-2021 05:20
Static task
static1
Behavioral task
behavioral1
Sample
ca221e91bfd2d2e7e93196c11ff4db0713f1e41675cc1f1b13b7b742c94612d0.exe
Resource
win7v20210408
0 signatures
0 seconds
General
-
Target
ca221e91bfd2d2e7e93196c11ff4db0713f1e41675cc1f1b13b7b742c94612d0.exe
-
Size
143KB
-
MD5
06f15879a3e68a2609e336d793c718c0
-
SHA1
ee7d3502ae1e54699a06719400e11b8e570a8aec
-
SHA256
ca221e91bfd2d2e7e93196c11ff4db0713f1e41675cc1f1b13b7b742c94612d0
-
SHA512
85d6ed14f552806065110ca1808770646ab8a6940aa79cc9ebb2e4086ca69448a40e11aad3425f6571dbc8b8942b08928c3c3541d22560c0e66f7e17e18b4730
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
prompthotspot.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat prompthotspot.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
prompthotspot.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07000f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 prompthotspot.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-bf-ca-a0-7c-46 prompthotspot.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\4a-bf-ca-a0-7c-46 prompthotspot.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings prompthotspot.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 prompthotspot.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionReason = "1" prompthotspot.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 prompthotspot.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" prompthotspot.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad prompthotspot.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecision = "0" prompthotspot.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadNetworkName = "Network" prompthotspot.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-bf-ca-a0-7c-46\WpadDecisionReason = "1" prompthotspot.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-bf-ca-a0-7c-46\WpadDecisionTime = 10846cc1a84ad701 prompthotspot.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-bf-ca-a0-7c-46\WpadDecision = "0" prompthotspot.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" prompthotspot.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix prompthotspot.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings prompthotspot.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" prompthotspot.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7} prompthotspot.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = 10846cc1a84ad701 prompthotspot.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections prompthotspot.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
prompthotspot.exepid process 832 prompthotspot.exe 832 prompthotspot.exe 832 prompthotspot.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
ca221e91bfd2d2e7e93196c11ff4db0713f1e41675cc1f1b13b7b742c94612d0.exepid process 1940 ca221e91bfd2d2e7e93196c11ff4db0713f1e41675cc1f1b13b7b742c94612d0.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
ca221e91bfd2d2e7e93196c11ff4db0713f1e41675cc1f1b13b7b742c94612d0.execa221e91bfd2d2e7e93196c11ff4db0713f1e41675cc1f1b13b7b742c94612d0.exeprompthotspot.exeprompthotspot.exepid process 1828 ca221e91bfd2d2e7e93196c11ff4db0713f1e41675cc1f1b13b7b742c94612d0.exe 1940 ca221e91bfd2d2e7e93196c11ff4db0713f1e41675cc1f1b13b7b742c94612d0.exe 1412 prompthotspot.exe 832 prompthotspot.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
ca221e91bfd2d2e7e93196c11ff4db0713f1e41675cc1f1b13b7b742c94612d0.exeprompthotspot.exedescription pid process target process PID 1828 wrote to memory of 1940 1828 ca221e91bfd2d2e7e93196c11ff4db0713f1e41675cc1f1b13b7b742c94612d0.exe ca221e91bfd2d2e7e93196c11ff4db0713f1e41675cc1f1b13b7b742c94612d0.exe PID 1828 wrote to memory of 1940 1828 ca221e91bfd2d2e7e93196c11ff4db0713f1e41675cc1f1b13b7b742c94612d0.exe ca221e91bfd2d2e7e93196c11ff4db0713f1e41675cc1f1b13b7b742c94612d0.exe PID 1828 wrote to memory of 1940 1828 ca221e91bfd2d2e7e93196c11ff4db0713f1e41675cc1f1b13b7b742c94612d0.exe ca221e91bfd2d2e7e93196c11ff4db0713f1e41675cc1f1b13b7b742c94612d0.exe PID 1828 wrote to memory of 1940 1828 ca221e91bfd2d2e7e93196c11ff4db0713f1e41675cc1f1b13b7b742c94612d0.exe ca221e91bfd2d2e7e93196c11ff4db0713f1e41675cc1f1b13b7b742c94612d0.exe PID 1412 wrote to memory of 832 1412 prompthotspot.exe prompthotspot.exe PID 1412 wrote to memory of 832 1412 prompthotspot.exe prompthotspot.exe PID 1412 wrote to memory of 832 1412 prompthotspot.exe prompthotspot.exe PID 1412 wrote to memory of 832 1412 prompthotspot.exe prompthotspot.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca221e91bfd2d2e7e93196c11ff4db0713f1e41675cc1f1b13b7b742c94612d0.exe"C:\Users\Admin\AppData\Local\Temp\ca221e91bfd2d2e7e93196c11ff4db0713f1e41675cc1f1b13b7b742c94612d0.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ca221e91bfd2d2e7e93196c11ff4db0713f1e41675cc1f1b13b7b742c94612d0.exe--52b829992⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\prompthotspot.exe"C:\Windows\SysWOW64\prompthotspot.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\prompthotspot.exe--66c2d2212⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/832-66-0x0000000000000000-mapping.dmp
-
memory/832-70-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1412-69-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1828-61-0x0000000000220000-0x0000000000231000-memory.dmpFilesize
68KB
-
memory/1828-62-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1940-60-0x0000000000000000-mapping.dmp
-
memory/1940-65-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB