Analysis
-
max time kernel
138s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
16-05-2022 16:21
Static task
static1
Behavioral task
behavioral1
Sample
d82767751280c173d75b7eac6591bcff4ee4e3e03a683cf6436635a873299daa.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
d82767751280c173d75b7eac6591bcff4ee4e3e03a683cf6436635a873299daa.exe
-
Size
172KB
-
MD5
c3d04a3a5520a2f58516c2f0acbd4055
-
SHA1
f97acd5a5384d81f003d382b5c3a5ac448a9bb62
-
SHA256
d82767751280c173d75b7eac6591bcff4ee4e3e03a683cf6436635a873299daa
-
SHA512
fd5bfb01b5f5c6d857620797ed4add60869ee662dcb5aaf721e3ee1a1fee01fcad08fd4b4b2eaa6dc626d6ac0438033f30d5affde3f12b159fdffe4bca5e41fd
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat alaskapolic.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 22 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 alaskapolic.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections alaskapolic.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 alaskapolic.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{562506FC-7F78-4683-BAED-0D58876A152A}\WpadDecision = "0" alaskapolic.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-ff-22-aa-d0-ba\WpadDetectedUrl alaskapolic.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings alaskapolic.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" alaskapolic.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0063000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 alaskapolic.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{562506FC-7F78-4683-BAED-0D58876A152A}\WpadDecisionReason = "1" alaskapolic.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0063000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 alaskapolic.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-ff-22-aa-d0-ba\WpadDecisionTime = 804b2eca5269d801 alaskapolic.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings alaskapolic.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{562506FC-7F78-4683-BAED-0D58876A152A} alaskapolic.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{562506FC-7F78-4683-BAED-0D58876A152A}\WpadDecisionTime = 20ddc28b5269d801 alaskapolic.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{562506FC-7F78-4683-BAED-0D58876A152A}\WpadNetworkName = "Network 3" alaskapolic.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-ff-22-aa-d0-ba alaskapolic.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{562506FC-7F78-4683-BAED-0D58876A152A}\86-ff-22-aa-d0-ba alaskapolic.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-ff-22-aa-d0-ba\WpadDecisionReason = "1" alaskapolic.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-ff-22-aa-d0-ba\WpadDecisionTime = 20ddc28b5269d801 alaskapolic.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad alaskapolic.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{562506FC-7F78-4683-BAED-0D58876A152A}\WpadDecisionTime = 804b2eca5269d801 alaskapolic.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-ff-22-aa-d0-ba\WpadDecision = "0" alaskapolic.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 1892 d82767751280c173d75b7eac6591bcff4ee4e3e03a683cf6436635a873299daa.exe 604 d82767751280c173d75b7eac6591bcff4ee4e3e03a683cf6436635a873299daa.exe 1164 alaskapolic.exe 1724 alaskapolic.exe 1724 alaskapolic.exe 1724 alaskapolic.exe 1724 alaskapolic.exe 1724 alaskapolic.exe 1724 alaskapolic.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 604 d82767751280c173d75b7eac6591bcff4ee4e3e03a683cf6436635a873299daa.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1892 wrote to memory of 604 1892 d82767751280c173d75b7eac6591bcff4ee4e3e03a683cf6436635a873299daa.exe 27 PID 1892 wrote to memory of 604 1892 d82767751280c173d75b7eac6591bcff4ee4e3e03a683cf6436635a873299daa.exe 27 PID 1892 wrote to memory of 604 1892 d82767751280c173d75b7eac6591bcff4ee4e3e03a683cf6436635a873299daa.exe 27 PID 1892 wrote to memory of 604 1892 d82767751280c173d75b7eac6591bcff4ee4e3e03a683cf6436635a873299daa.exe 27 PID 1164 wrote to memory of 1724 1164 alaskapolic.exe 29 PID 1164 wrote to memory of 1724 1164 alaskapolic.exe 29 PID 1164 wrote to memory of 1724 1164 alaskapolic.exe 29 PID 1164 wrote to memory of 1724 1164 alaskapolic.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\d82767751280c173d75b7eac6591bcff4ee4e3e03a683cf6436635a873299daa.exe"C:\Users\Admin\AppData\Local\Temp\d82767751280c173d75b7eac6591bcff4ee4e3e03a683cf6436635a873299daa.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\d82767751280c173d75b7eac6591bcff4ee4e3e03a683cf6436635a873299daa.exe"C:\Users\Admin\AppData\Local\Temp\d82767751280c173d75b7eac6591bcff4ee4e3e03a683cf6436635a873299daa.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:604
-
-
C:\Windows\SysWOW64\alaskapolic.exe"C:\Windows\SysWOW64\alaskapolic.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\SysWOW64\alaskapolic.exe"C:\Windows\SysWOW64\alaskapolic.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1724
-