Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
10-02-2022 21:59
Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
speco_plugin.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
speco_plugin.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral5
Sample
system.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral6
Sample
system.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
speco_plugin.exe
-
Size
1.1MB
-
MD5
53e4b14faf1e046d09c36b918442b06a
-
SHA1
79bd631bf2f369af6139af3b67a815d62bbbabb9
-
SHA256
5f88f1f8fb79311e568d194eee42c817d2883ebaa6d1afbccb1a9b2d4de7b5c8
-
SHA512
b6698dcf9a2db51d4c28d1f65ec7f432c3b4b6a5b14e82af08d5c4d84aa568d38f25cde3de2438db22e9615633abec3a83ad06b73ecbf190134e39660b259c15
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1916 Setup.exe 284 IKernel.exe 1856 IKernel.exe 1996 iKernel.exe -
Loads dropped DLL 26 IoCs
pid Process 1276 speco_plugin.exe 1916 Setup.exe 1916 Setup.exe 1916 Setup.exe 1916 Setup.exe 284 IKernel.exe 284 IKernel.exe 284 IKernel.exe 1856 IKernel.exe 1856 IKernel.exe 1856 IKernel.exe 1856 IKernel.exe 1856 IKernel.exe 1856 IKernel.exe 1856 IKernel.exe 1856 IKernel.exe 1996 iKernel.exe 1996 iKernel.exe 1996 iKernel.exe 1856 IKernel.exe 1916 Setup.exe 1856 IKernel.exe 1856 IKernel.exe 1856 IKernel.exe 1856 IKernel.exe 1856 IKernel.exe -
Drops file in Program Files directory 12 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\objecc06.rra IKernel.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\objectps.dll IKernel.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\IScript\IScript.dll IKernel.exe File created C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\corecb5a.rra IKernel.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\corecomp.ini IKernel.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\ctor.dll IKernel.exe File created C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iusecc15.rra IKernel.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iuser.dll IKernel.exe File created C:\Program Files (x86)\Common Files\InstallShield\IScript\IScrccc1.rra IKernel.exe File created C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\temp.000 Setup.exe File opened for modification C:\PROGRA~2\COMMON~1\INSTAL~1\engine\6\INTEL3~1\corecomp.ini IKernel.exe File created C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\ctorcb79.rra IKernel.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C3C1B12-E59D-11D2-B40B-00A024B9DDDD}\ProxyStubClsid32 IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2583251F-0A04-11D3-886B-00C04F72F303}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF57A6F0-4101-11D3-88F6-00C04F72F303}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B1B8830-C559-11D3-B289-00C04F59FBE9}\ProxyStubClsid32 IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8c3c1b17-e59d-11d2-b40b-00a024b9dddd} IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2583251F-0A04-11D3-886B-00C04F72F303}\TypeLib\Version = "1.0" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE6115A1-7DE5-48DC-AD2A-25060E00FCE2}\TypeLib\Version = "1.0" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3EE77D8B-40C1-4A2A-9B77-421907F02058}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8415DE38-1C1D-11D3-889D-00C04F72F303}\ = "ISetupShellLink" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{39040274-3D36-11D3-88EE-00C04F72F303} IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{65D37452-0EBB-11D3-887B-00C04F72F303}\ProxyStubClsid32 IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{251753FA-FB3B-11D2-8842-00C04F72F303}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AFED5DD0-0694-11D4-A934-00105A088FAC}\TypeLib IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AA7E2062-CB55-11D2-8094-00104B1F9838}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}" iKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{44D61997-B7D4-11D2-80BA-00104B1F6CEA}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91814EC1-B5F0-11D2-80B9-00104B1F6CEA} IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF57A6F1-4101-11D3-88F6-00C04F72F303}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DAB9BF17-267D-11D3-88B6-00C04F72F303}\ = "ISetupTextSubstitution" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7BB118F1-6D5B-470E-82D0-AFB042724560}\ProxyStubClsid32 IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AFED5DD0-0694-11D4-A934-00105A088FAC} IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{15F051E6-59A9-11D3-A25D-06D730000000}\ = "ISetupScriptError" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{761C8359-55AF-4E7B-9C83-C1A927E0F617}\ProxyStubClsid32 IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1F9922A2-F026-11D2-8822-00C04F72F303}\ = "ISetupObjectContext" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7D795704-435D-11D3-88FF-00C04F72F303}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2067-CB55-11D2-8094-00104B1F9838}\TypeLib\ = "{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8C3C1B10-E59D-11D2-B40B-00A024B9DDDD}\TypeLib\ = "{27D2CF3C-D5B0-11D2-8094-00104B1F9838}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F4817E4B-04B6-11D3-8862-00C04F72F303}\ = "ISetupServiceProvider" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91814EC0-B5F0-11D2-80B9-00104B1F6CEA}\LocalServer32 IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{91814EB1-B5F0-11D2-80B9-00104B1F6CEA}\1.0 IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AA7E2084-CB55-11D2-8094-00104B1F9838} IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8415DDF9-1C1D-11D3-889D-00C04F72F303} IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{112EB4F0-5A48-11D3-A90A-00105A088FAC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C3C1B12-E59D-11D2-B40B-00A024B9DDDD}\TypeLib\Version = "1.0" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3EE77D8B-40C1-4A2A-9B77-421907F02058}\ProxyStubClsid32 IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AA7E2064-CB55-11D2-8094-00104B1F9838}\TypeLib IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{682C25C5-D7D9-11D2-80C5-00104B1F6CEA}\1.0\FLAGS\ = "0" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91814EBF-B5F0-11D2-80B9-00104B1F6CEA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0BA4BA22-2EF0-11D3-88C8-00C04F72F303}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B15A454-9067-4878-B10E-B9DFFE03049D} IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4FF39BB-1A05-11D3-8896-00C04F72F303}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF57A6F0-4101-11D3-88F6-00C04F72F303}\TypeLib IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9E561C6B-425D-4E3D-95CA-A2D289D7C3FB}\ = "ISetupMainWindow4" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{61892D50-28EF-11D3-A8FF-00105A088FAC}\TypeLib\Version = "1.0" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0BA4BA22-2EF0-11D3-88C8-00C04F72F303}\TypeLib IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8C3C1B12-E59D-11D2-B40B-00A024B9DDDD}\TypeLib\ = "{682C25C5-D7D9-11D2-80C5-00104B1F6CEA}" IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{91814EC1-B5F0-11D2-80B9-00104B1F6CEA}\TypeLib\Version = "1.0" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AA7E2069-CB55-11D2-8094-00104B1F9838}\TypeLib IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D4FF39BB-1A05-11D3-8896-00C04F72F303}\TypeLib IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DAB9BF17-267D-11D3-88B6-00C04F72F303}\ProxyStubClsid32 IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{54DADAB3-28A6-11D3-88BA-00C04F72F303}\TypeLib IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{54DADAB2-28A6-11D3-88BA-00C04F72F303} IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Setup.Kernel.1 iKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EDE94BF2-4FB9-11D5-ABAB-00B0D02332EB}\TypeLib IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{91814EC0-B5F0-11D2-80B9-00104B1F6CEA}\VersionIndependentProgID IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3EE77D8B-40C1-4A2A-9B77-421907F02058} IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{65D37452-0EBB-11D3-887B-00C04F72F303}\TypeLib IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C4AAC3B1-C547-11D3-B289-00C04F59FBE9}\TypeLib IKernel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C8D0880-1AC4-11D3-A8FF-00105A088FAC}\TypeLib\Version = "1.0" IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BDF8B49D-16D0-49A5-B133-ABE7DCC23DAF} IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D8B6332-D8B1-11D2-80C5-00104B1F6CEA}\ProxyStubClsid32 IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8C3C1B12-E59D-11D2-B40B-00A024B9DDDD} IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8C3C1B10-E59D-11D2-B40B-00A024B9DDDD}\TypeLib IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C3C1B15-E59D-11D2-B40B-00A024B9DDDD}\TypeLib IKernel.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D4FF39BB-1A05-11D3-8896-00C04F72F303} IKernel.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1276 wrote to memory of 1916 1276 speco_plugin.exe 27 PID 1276 wrote to memory of 1916 1276 speco_plugin.exe 27 PID 1276 wrote to memory of 1916 1276 speco_plugin.exe 27 PID 1276 wrote to memory of 1916 1276 speco_plugin.exe 27 PID 1276 wrote to memory of 1916 1276 speco_plugin.exe 27 PID 1276 wrote to memory of 1916 1276 speco_plugin.exe 27 PID 1276 wrote to memory of 1916 1276 speco_plugin.exe 27 PID 1916 wrote to memory of 284 1916 Setup.exe 28 PID 1916 wrote to memory of 284 1916 Setup.exe 28 PID 1916 wrote to memory of 284 1916 Setup.exe 28 PID 1916 wrote to memory of 284 1916 Setup.exe 28 PID 1916 wrote to memory of 284 1916 Setup.exe 28 PID 1916 wrote to memory of 284 1916 Setup.exe 28 PID 1916 wrote to memory of 284 1916 Setup.exe 28 PID 1856 wrote to memory of 1996 1856 IKernel.exe 30 PID 1856 wrote to memory of 1996 1856 IKernel.exe 30 PID 1856 wrote to memory of 1996 1856 IKernel.exe 30 PID 1856 wrote to memory of 1996 1856 IKernel.exe 30 PID 1856 wrote to memory of 1996 1856 IKernel.exe 30 PID 1856 wrote to memory of 1996 1856 IKernel.exe 30 PID 1856 wrote to memory of 1996 1856 IKernel.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\speco_plugin.exe"C:\Users\Admin\AppData\Local\Temp\speco_plugin.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\pftC055~tmp\Disk1\Setup.exe"C:\Users\Admin\AppData\Local\Temp\pftC055~tmp\Disk1\Setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\IKernel.exe"C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\IKernel.exe" -RegServer3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:284
-
-
-
C:\PROGRA~2\COMMON~1\INSTAL~1\engine\6\INTEL3~1\IKernel.exeC:\PROGRA~2\COMMON~1\INSTAL~1\engine\6\INTEL3~1\IKernel.exe -Embedding1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe"C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iKernel.exe" /REGSERVER2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1996
-