Analysis
-
max time kernel
95s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220331-en -
submitted
07-04-2022 19:52
Static task
static1
Behavioral task
behavioral1
Sample
d1a2a1e22c9667d4ff6c4a89a0e43473e79c4d89b4690176361550aaf4352941.exe
Resource
win7-20220331-en
General
-
Target
d1a2a1e22c9667d4ff6c4a89a0e43473e79c4d89b4690176361550aaf4352941.exe
-
Size
47KB
-
MD5
03b7e356bdc47452c7710c566d33b12d
-
SHA1
dd2f19962dadeba05a5299b32343fb37221af0b9
-
SHA256
d1a2a1e22c9667d4ff6c4a89a0e43473e79c4d89b4690176361550aaf4352941
-
SHA512
d77a717048797e9328c7cdc17eba4b32b03c84fabf8530e10dc82b3e7839f1a63487eb5f07eb9bb3aa2451abaeed3ab7b23d866c078f0161b22357e792457166
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
Processes:
d1a2a1e22c9667d4ff6c4a89a0e43473e79c4d89b4690176361550aaf4352941.exedescription ioc process File created C:\Windows\SysWOW64\Webhost.pif d1a2a1e22c9667d4ff6c4a89a0e43473e79c4d89b4690176361550aaf4352941.exe File created C:\Windows\SysWOW64\Webnec.pif d1a2a1e22c9667d4ff6c4a89a0e43473e79c4d89b4690176361550aaf4352941.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0d75c1ccc4ad801 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002ac970f6e21c8045b4ad45959768992c00000000020000000000106600000001000020000000db12cd6218e755aaf0676e6a2096d3d956c64d13afddfc1dc986e4fcd296a2c5000000000e8000000002000020000000546d25a6b176e019d74927fd68c83bd8bb4fb814ab081ae21aee3211e922c72420000000be07f3e15e9d02f00ba0dd4ba2f37b83157c59b9033971d3f08d0b79373cc167400000005359765180ffc3aed0e2c92c51f2da3bb42828f1bf7869375f5964778a69399f8ea989d3cac6cd2e96742a494f4dcbf7e97ccd2d588896de0468bd2894b09187 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002ac970f6e21c8045b4ad45959768992c00000000020000000000106600000001000020000000825c5ba53b730f33089401618cf6f3760c4411f13def2d78c904d6eae6184f51000000000e800000000200002000000037811be13c7b597c547c944a7fdd5288168a44b3628620e11c64a3eefb6a14e49000000070df7975c97b271ec8a0106ff5f443b30d214cdebebe8f0f75c7b1212ffe3c8197cee0863c405f567d7c544a5cf1cdc5c92192c4f5d2438a47ea56ca8849dae54415abbf89da4a780380af45053695b94279e5c2ce2aa111bbe1b008276be6515b5e81886b77977b5e5bb3b2031711a4d5eb591bababf50069bd6aed40c286e81613480e5002c9331539e9b46ce4e127400000002218cf8c98ea12399260a2f5e9804ce6f5ad70f6074a840f03ad4276402625976de6ecae5f6caf198e593fe01e8c8eb0e3930ca65c30334e00fd35af32995059 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3BB4DBC1-B6BF-11EC-97B7-C270349D506E} = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "356134278" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 1416 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEpid process 1416 IEXPLORE.EXE 1416 IEXPLORE.EXE 1916 IEXPLORE.EXE 1916 IEXPLORE.EXE 1916 IEXPLORE.EXE 1916 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
d1a2a1e22c9667d4ff6c4a89a0e43473e79c4d89b4690176361550aaf4352941.exeiexplore.exeIEXPLORE.EXEdescription pid process target process PID 1796 wrote to memory of 808 1796 d1a2a1e22c9667d4ff6c4a89a0e43473e79c4d89b4690176361550aaf4352941.exe iexplore.exe PID 1796 wrote to memory of 808 1796 d1a2a1e22c9667d4ff6c4a89a0e43473e79c4d89b4690176361550aaf4352941.exe iexplore.exe PID 1796 wrote to memory of 808 1796 d1a2a1e22c9667d4ff6c4a89a0e43473e79c4d89b4690176361550aaf4352941.exe iexplore.exe PID 1796 wrote to memory of 808 1796 d1a2a1e22c9667d4ff6c4a89a0e43473e79c4d89b4690176361550aaf4352941.exe iexplore.exe PID 808 wrote to memory of 1416 808 iexplore.exe IEXPLORE.EXE PID 808 wrote to memory of 1416 808 iexplore.exe IEXPLORE.EXE PID 808 wrote to memory of 1416 808 iexplore.exe IEXPLORE.EXE PID 808 wrote to memory of 1416 808 iexplore.exe IEXPLORE.EXE PID 1416 wrote to memory of 1916 1416 IEXPLORE.EXE IEXPLORE.EXE PID 1416 wrote to memory of 1916 1416 IEXPLORE.EXE IEXPLORE.EXE PID 1416 wrote to memory of 1916 1416 IEXPLORE.EXE IEXPLORE.EXE PID 1416 wrote to memory of 1916 1416 IEXPLORE.EXE IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1a2a1e22c9667d4ff6c4a89a0e43473e79c4d89b4690176361550aaf4352941.exe"C:\Users\Admin\AppData\Local\Temp\d1a2a1e22c9667d4ff6c4a89a0e43473e79c4d89b4690176361550aaf4352941.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" www.google.com.br2⤵
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" www.google.com.br3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1416 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1916
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD568c1395cf6359ef556a43626081a1831
SHA1f29940a1b066a7f977515479aa3fcde6b357f71b
SHA256357de816e7796dd7e9a441a980388611ce78cb7acdbc9edb923616c7aa6ef868
SHA512487eab1afa9e44f724af74d8eeb5f56e94ba8493dcb0ebb8b1052691544de41734c7e80331006cfdad2880313f6b9adae30aa647556e4f81912bd65e8d0901fc
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\b1rou5u\imagestore.datFilesize
9KB
MD5d7dfeb4fd89dac7ee7785ff7783482d3
SHA137e5780b3d45f3cb4e1d61f0e68d33f727f2a90b
SHA25613739f20d2850d570828ec336a75c5a40faad0b3f3e3b6add9a32d1d84192552
SHA5123cf11e3341c6a11ba5b99ec6bb32e81b635e00a1c00ed2917e56bcf2d094c344f04a31cc01819372498200094af5d7ad93ac020a920efce7016f3a91b293d0d1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\T56ZV2EU.txtFilesize
595B
MD5a60d8d1f97c7b95223c6433bc21eb355
SHA162712e596a3a1d846c676dceef4c3722049c74bc
SHA2569ff146c6c3701d1d966748b6a3ebfc8b5f36f015aa5a49324b1c4debf3c1a87a
SHA512e4cf8808faee6abbac00f0db5aeb47c3709714ab9a2881ccc9e11b199eabd564b31d70d8cbffd38fd24fe374350bbe4feabc88e1444e93c8536ff55a13639f90
-
memory/1796-54-0x0000000075A51000-0x0000000075A53000-memory.dmpFilesize
8KB
-
memory/1796-55-0x00000000002A0000-0x00000000002A2000-memory.dmpFilesize
8KB