Resubmissions
03/11/2022, 09:46
221103-lrnd1sghc5322/09/2022, 15:06
220922-sgtavafedj314/10/2021, 16:48
211014-vbeavaaad5822/09/2021, 05:58
210922-gpdpksecgk822/09/2021, 05:36
210922-gax5nsecdn8Analysis
- max time kernel
126s - max time network
238s - platform
windows7_x64 - resource
win7v20210408 - submitted
22/09/2021, 05:58
Static task
static1
Behavioral task
behavioral1
Sample
manual64.dll
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
- Target manual64.dll
- Size 184KB
- Sample210922-gpdpksecgk
- SHA256 c74873d7b8cc622379ed49bd0b0e477167ae176aa329b01338666ec4c1a4426b
- MD5 d35a5caf8af43432ec2f5a2318b20597
- SHA1 8fd8f62a848a1d9c1ff18c7bc16e8a6d2c67c37e
- SHA512 7de9c021c2e64c564ba8ac5c0f1914718c240a382bc717dd7e93122a0a51c849c263ae0438eae5c324ca1e5c3d346c2a09ab7fc63bbaa598e3973943a5d84263
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification \??\c:\Users\Admin\Pictures\TraceMove.tiff rundll32.exe File renamed C:\Users\Admin\Pictures\TraceMove.tiff => \??\c:\Users\Admin\Pictures\TraceMove.tiff.quantum rundll32.exe File renamed C:\Users\Admin\Pictures\LimitUnregister.png => \??\c:\Users\Admin\Pictures\LimitUnregister.png.quantum rundll32.exe File renamed C:\Users\Admin\Pictures\PingGet.tif => \??\c:\Users\Admin\Pictures\PingGet.tif.quantum rundll32.exe File renamed C:\Users\Admin\Pictures\StartSend.png => \??\c:\Users\Admin\Pictures\StartSend.png.quantum rundll32.exe - Deletes itself 1 IoCs
pid Process 768 cmd.exe - Drops desktop.ini file(s) 32 IoCs
description ioc Process File opened for modification \??\c:\Users\Admin\Downloads\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Music\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Saved Games\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Libraries\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Pictures\Sample Pictures\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\NU1L7O13\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\VNYR844D\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Favorites\Links for United States\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\E9RC2MV6\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Favorites\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Pictures\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Videos\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Contacts\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Favorites\Links\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Desktop\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Music\Sample Music\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Recorded TV\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Searches\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\H18KNA1T\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Music\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Pictures\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Recorded TV\Sample Media\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Videos\Sample Videos\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Desktop\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Documents\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Admin\Links\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Documents\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Downloads\desktop.ini rundll32.exe File opened for modification \??\c:\Users\Public\Videos\desktop.ini rundll32.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File created \??\c:\Program Files\README_TO_DECRYPT.html rundll32.exe File created \??\c:\Program Files (x86)\README_TO_DECRYPT.html rundll32.exe File created \??\c:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\README_TO_DECRYPT.html rundll32.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e655bd65424d0543a2c7a396214de4cb00000000020000000000106600000001000020000000554a0515208cf6264bdd91a12989dc32493bb0cde2f6ca274658d49782513e52000000000e80000000020000200000006cc77368e7a30c1bb8b5712555f65564571ff70782a895fe9e5cb107df0222bf200000003a2ec71d437d2563fd98bfab57645e4ded9e012336d3d93f8db6c5b944001c454000000051c26c85aba7c3efa803b726e63ef9cb50549c10d461f7248ba8f1eed68139cd2eb87edde5edeb145d9c28591c13417684dd48006ddd2c3d2078b4f7cede93b9 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\User Preferences iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\User Preferences\2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e655bd65424d0543a2c7a396214de4cb000000000200000000001066000000010000200000001197a5f732cd517cefad18713c9d61c668ab1dd8f296ddc014f0eeb0934e9aff000000000e800000000200002000000033683bf75c664892327e59a350779b8a40307183a9b1bac9c179f5babc3d81c91000000035c4f4c7643cb289514b292e8e2fc04b40000000a16d5b6adc5222445a631b518a0f0405aa0138f262ad7c24081dc263dd815e54dbf72f4845b1aa3fb5bb47283ea77b31c60339617d93f6eff84b9b2306399626 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e655bd65424d0543a2c7a396214de4cb000000000200000000001066000000010000200000002916d5ba915a187d0468867cea065f449b235eda8b48c973057aa6fe519ba076000000000e8000000002000020000000659735d485458f9a9641010efdb5ec7e437d43fcf7b37ce2962ac5b391b82838900000006e6ccd987db9cc3f63d241a69e4ce8adf8999ccf98feccc6ffd5f456561556b587a0d492f9023a0ff806832cee84697c4bf1720d1fe57338d8317a123f5719a10ad54c2053d58faa27c622db193b40ad977e71886b3d233f53e6cfaec7deca197bc61e775eca4d07f844bf39612bd69912b1ce96ea2425dff1bcc51cdb5165834fc67727bc95535a6b1dacd8de3527e24000000035439c6ec865f74c47088df1dedb84f46bb3a9c560ac119bf3dfa31aefbd238679d73ab63d1711fcfafbd63991c3fc5bb3ee9b70a3566d15c2ae8bee96bea369 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 200075dc87afd701 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\User Preferences\88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e655bd65424d0543a2c7a396214de4cb00000000020000000000106600000001000020000000ca8366b964bad66fddcdb35dcb3b79e0271142e7e3a29275e3bba4c4994b5cf7000000000e8000000002000020000000fc785702f0bbba81279190198c71565df2681e0cb7bae1800b97e517d28af7395000000003d33f4d8be44c7bbe694b19915c0a6fc3c2edda88ca15aa8435f04ba25908171f037b0970bf20915c6eccf63204037df88dabf078e70abbc773db4c91ff511574bc742e968a39c606c461f3e4d1985d40000000988fe3c72d4bd450c094c4c20c6613a770cefd80a576e9dd9f17c0f6e1af20acfdcd5458a68b3fa6ad3004f5ba6d4bb63c270b11791a7500af25a17561273257 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "339062549" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{050FB6B1-1B7B-11EC-9091-EA64D349DA9B} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\.quantum\shell\Open\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\.quantum rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\.quantum\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\.quantum\shell\Open rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\.quantum\shell\Open\command\ = "explorer.exe README_TO_DECRYPT.html" rundll32.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1296 rundll32.exe 1296 rundll32.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 1296 rundll32.exe Token: SeDebugPrivilege 1296 rundll32.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 500 iexplore.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 500 iexplore.exe 500 iexplore.exe 1612 IEXPLORE.EXE 1612 IEXPLORE.EXE 1612 IEXPLORE.EXE 1612 IEXPLORE.EXE 1612 IEXPLORE.EXE 1612 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 500 wrote to memory of 1612 500 iexplore.exe 30 PID 500 wrote to memory of 1612 500 iexplore.exe 30 PID 500 wrote to memory of 1612 500 iexplore.exe 30 PID 500 wrote to memory of 1612 500 iexplore.exe 30 PID 1296 wrote to memory of 768 1296 rundll32.exe 31 PID 1296 wrote to memory of 768 1296 rundll32.exe 31 PID 1296 wrote to memory of 768 1296 rundll32.exe 31 PID 768 wrote to memory of 2004 768 cmd.exe 33 PID 768 wrote to memory of 2004 768 cmd.exe 33 PID 768 wrote to memory of 2004 768 cmd.exe 33 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2004 attrib.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\manual64.dll,#11⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\\00026C68.bat" "C:\Users\Admin\AppData\Local\Temp\manual64.dll""2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\system32\attrib.exeattrib -s -r -h "C:\Users\Admin\AppData\Local\Temp\manual64.dll"3⤵
- Views/modifies file attributes
PID:2004
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\README_TO_DECRYPT.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:500 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:500 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1612
-