Analysis
-
max time kernel
132s -
max time network
140s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
16-05-2021 04:25
Static task
static1
Behavioral task
behavioral1
Sample
ef542a6656488836225eab031154badda2b5ec3ee52f12f5eaca4bb73a4151e2.exe
Resource
win7v20210410
0 signatures
0 seconds
General
-
Target
ef542a6656488836225eab031154badda2b5ec3ee52f12f5eaca4bb73a4151e2.exe
-
Size
162KB
-
MD5
9500a8ed79991a7c9276e62b663df95e
-
SHA1
d2e5add104ece763d0de4abb0c22129f61852144
-
SHA256
ef542a6656488836225eab031154badda2b5ec3ee52f12f5eaca4bb73a4151e2
-
SHA512
ef3ddf271c2fd4e56f3511f825ae66983ba788d03457f3560358859dab6b32444ad322f4c8530e5648e3a3f837acb032ae241c7fe11ced7b2cfe56ae3c08af99
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
titleiell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat titleiell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
titleiell.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionReason = "1" titleiell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77 titleiell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections titleiell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" titleiell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32} titleiell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070023000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 titleiell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1" titleiell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 40100d79894ad701 titleiell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0" titleiell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 titleiell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix titleiell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 titleiell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionTime = 40100d79894ad701 titleiell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecision = "0" titleiell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\32-e2-17-db-d2-77 titleiell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" titleiell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" titleiell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings titleiell.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings titleiell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad titleiell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadNetworkName = "Network" titleiell.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
titleiell.exepid process 1656 titleiell.exe 1656 titleiell.exe 1656 titleiell.exe 1656 titleiell.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
ef542a6656488836225eab031154badda2b5ec3ee52f12f5eaca4bb73a4151e2.exepid process 1712 ef542a6656488836225eab031154badda2b5ec3ee52f12f5eaca4bb73a4151e2.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
ef542a6656488836225eab031154badda2b5ec3ee52f12f5eaca4bb73a4151e2.exeef542a6656488836225eab031154badda2b5ec3ee52f12f5eaca4bb73a4151e2.exetitleiell.exetitleiell.exepid process 2004 ef542a6656488836225eab031154badda2b5ec3ee52f12f5eaca4bb73a4151e2.exe 1712 ef542a6656488836225eab031154badda2b5ec3ee52f12f5eaca4bb73a4151e2.exe 1780 titleiell.exe 1656 titleiell.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
ef542a6656488836225eab031154badda2b5ec3ee52f12f5eaca4bb73a4151e2.exetitleiell.exedescription pid process target process PID 2004 wrote to memory of 1712 2004 ef542a6656488836225eab031154badda2b5ec3ee52f12f5eaca4bb73a4151e2.exe ef542a6656488836225eab031154badda2b5ec3ee52f12f5eaca4bb73a4151e2.exe PID 2004 wrote to memory of 1712 2004 ef542a6656488836225eab031154badda2b5ec3ee52f12f5eaca4bb73a4151e2.exe ef542a6656488836225eab031154badda2b5ec3ee52f12f5eaca4bb73a4151e2.exe PID 2004 wrote to memory of 1712 2004 ef542a6656488836225eab031154badda2b5ec3ee52f12f5eaca4bb73a4151e2.exe ef542a6656488836225eab031154badda2b5ec3ee52f12f5eaca4bb73a4151e2.exe PID 2004 wrote to memory of 1712 2004 ef542a6656488836225eab031154badda2b5ec3ee52f12f5eaca4bb73a4151e2.exe ef542a6656488836225eab031154badda2b5ec3ee52f12f5eaca4bb73a4151e2.exe PID 1780 wrote to memory of 1656 1780 titleiell.exe titleiell.exe PID 1780 wrote to memory of 1656 1780 titleiell.exe titleiell.exe PID 1780 wrote to memory of 1656 1780 titleiell.exe titleiell.exe PID 1780 wrote to memory of 1656 1780 titleiell.exe titleiell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef542a6656488836225eab031154badda2b5ec3ee52f12f5eaca4bb73a4151e2.exe"C:\Users\Admin\AppData\Local\Temp\ef542a6656488836225eab031154badda2b5ec3ee52f12f5eaca4bb73a4151e2.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ef542a6656488836225eab031154badda2b5ec3ee52f12f5eaca4bb73a4151e2.exe--5d7f8462⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\titleiell.exe"C:\Windows\SysWOW64\titleiell.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\titleiell.exe--b4ba1d2a2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1656-68-0x0000000000000000-mapping.dmp
-
memory/1712-61-0x0000000000000000-mapping.dmp
-
memory/2004-59-0x00000000765F1000-0x00000000765F3000-memory.dmpFilesize
8KB
-
memory/2004-60-0x0000000000220000-0x0000000000231000-memory.dmpFilesize
68KB
-
memory/2004-63-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB