Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
16-05-2021 04:11
Static task
static1
Behavioral task
behavioral1
Sample
541acc77f8bc50ff4fb2102da1795047ff6716677e166ca4e8234fffa3622414.exe
Resource
win7v20210410
0 signatures
0 seconds
General
-
Target
541acc77f8bc50ff4fb2102da1795047ff6716677e166ca4e8234fffa3622414.exe
-
Size
149KB
-
MD5
aa825e9a91290eb8bb60c6da3687a70c
-
SHA1
246868a8c1e70bb6c63411517140af7e4104aeb4
-
SHA256
541acc77f8bc50ff4fb2102da1795047ff6716677e166ca4e8234fffa3622414
-
SHA512
f34fe96933dedd568aa015865b3d1adeec1db7e0bc02300d1da2e86c68f40aef8d97c184db060793d67901325a6e14aebbf2562c8f9f3c660d95e41a2d508283
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
adtlangs.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat adtlangs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
adtlangs.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix adtlangs.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070015000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 adtlangs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32} adtlangs.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 adtlangs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings adtlangs.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" adtlangs.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionReason = "1" adtlangs.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1" adtlangs.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 7005734c854ad701 adtlangs.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" adtlangs.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionTime = 7005734c854ad701 adtlangs.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecision = "0" adtlangs.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadNetworkName = "Network" adtlangs.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0" adtlangs.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 adtlangs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections adtlangs.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" adtlangs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad adtlangs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77 adtlangs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\32-e2-17-db-d2-77 adtlangs.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings adtlangs.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
adtlangs.exepid process 1452 adtlangs.exe 1452 adtlangs.exe 1452 adtlangs.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
541acc77f8bc50ff4fb2102da1795047ff6716677e166ca4e8234fffa3622414.exepid process 1700 541acc77f8bc50ff4fb2102da1795047ff6716677e166ca4e8234fffa3622414.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
541acc77f8bc50ff4fb2102da1795047ff6716677e166ca4e8234fffa3622414.exe541acc77f8bc50ff4fb2102da1795047ff6716677e166ca4e8234fffa3622414.exeadtlangs.exeadtlangs.exepid process 1816 541acc77f8bc50ff4fb2102da1795047ff6716677e166ca4e8234fffa3622414.exe 1700 541acc77f8bc50ff4fb2102da1795047ff6716677e166ca4e8234fffa3622414.exe 1520 adtlangs.exe 1452 adtlangs.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
541acc77f8bc50ff4fb2102da1795047ff6716677e166ca4e8234fffa3622414.exeadtlangs.exedescription pid process target process PID 1816 wrote to memory of 1700 1816 541acc77f8bc50ff4fb2102da1795047ff6716677e166ca4e8234fffa3622414.exe 541acc77f8bc50ff4fb2102da1795047ff6716677e166ca4e8234fffa3622414.exe PID 1816 wrote to memory of 1700 1816 541acc77f8bc50ff4fb2102da1795047ff6716677e166ca4e8234fffa3622414.exe 541acc77f8bc50ff4fb2102da1795047ff6716677e166ca4e8234fffa3622414.exe PID 1816 wrote to memory of 1700 1816 541acc77f8bc50ff4fb2102da1795047ff6716677e166ca4e8234fffa3622414.exe 541acc77f8bc50ff4fb2102da1795047ff6716677e166ca4e8234fffa3622414.exe PID 1816 wrote to memory of 1700 1816 541acc77f8bc50ff4fb2102da1795047ff6716677e166ca4e8234fffa3622414.exe 541acc77f8bc50ff4fb2102da1795047ff6716677e166ca4e8234fffa3622414.exe PID 1520 wrote to memory of 1452 1520 adtlangs.exe adtlangs.exe PID 1520 wrote to memory of 1452 1520 adtlangs.exe adtlangs.exe PID 1520 wrote to memory of 1452 1520 adtlangs.exe adtlangs.exe PID 1520 wrote to memory of 1452 1520 adtlangs.exe adtlangs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\541acc77f8bc50ff4fb2102da1795047ff6716677e166ca4e8234fffa3622414.exe"C:\Users\Admin\AppData\Local\Temp\541acc77f8bc50ff4fb2102da1795047ff6716677e166ca4e8234fffa3622414.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\541acc77f8bc50ff4fb2102da1795047ff6716677e166ca4e8234fffa3622414.exe--d5248a572⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\adtlangs.exe"C:\Windows\SysWOW64\adtlangs.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\adtlangs.exe--1a7282662⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1452-67-0x0000000000000000-mapping.dmp
-
memory/1700-61-0x0000000000000000-mapping.dmp
-
memory/1700-65-0x00000000752B1000-0x00000000752B3000-memory.dmpFilesize
8KB
-
memory/1816-60-0x00000000001C0000-0x00000000001D1000-memory.dmpFilesize
68KB
-
memory/1816-62-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB