Analysis
-
max time kernel
173s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 22:55
Static task
static1
Behavioral task
behavioral1
Sample
b266716ff41ca7d2a05994174c5f75083081c9dfd5b6fb8abb7f2a7c0e373950.exe
Resource
win7-20220414-en
General
-
Target
b266716ff41ca7d2a05994174c5f75083081c9dfd5b6fb8abb7f2a7c0e373950.exe
-
Size
603KB
-
MD5
202a640b5da9a32d7050cf39eb0f7726
-
SHA1
d499984e6bd951514997ded82485e10844b329f6
-
SHA256
b266716ff41ca7d2a05994174c5f75083081c9dfd5b6fb8abb7f2a7c0e373950
-
SHA512
20d46542201adab3da36a971f35cee594036ec3164bc990f9b7bba3b8a8d82c69e323a7b445b9a4045e4e3266e70e1b885d7c78e30ca34bdb111b2966ddb41c0
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Dllhost.exepid process 4896 Dllhost.exe -
Modifies Windows Firewall 1 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b266716ff41ca7d2a05994174c5f75083081c9dfd5b6fb8abb7f2a7c0e373950.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation b266716ff41ca7d2a05994174c5f75083081c9dfd5b6fb8abb7f2a7c0e373950.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 7 IoCs
Processes:
b266716ff41ca7d2a05994174c5f75083081c9dfd5b6fb8abb7f2a7c0e373950.exeDllhost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\CID\{45007100-4A00-5000-6F00-380074006A00} b266716ff41ca7d2a05994174c5f75083081c9dfd5b6fb8abb7f2a7c0e373950.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\CID\{45007100-4A00-5000-6F00-380074006A00}\1 = "7NIBxAIaKgV7A5/uTKUir3xoe/XFBsDAQJa248vV0RLLB8sVb5AEshVikaCZVol+yyy/bOUn/XI/fCrCG7qcUTqeB73h0qbXvxeN7utKGUSInXEBOahizDQl908f+/pZoTJMpTDUUmQogjtP1YmHTR6JS0cxCU+i08wfUnPyVBb0E5abFxOEFobO4hkHpBAo" b266716ff41ca7d2a05994174c5f75083081c9dfd5b6fb8abb7f2a7c0e373950.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\CID\{78006D00-6900-3500-4D00-470059004100}\1 = "Evgbxea2DKZzh/U+YxcVXvD41ENZQmT9blZoTFtPfAWy0sKL5Z4kMHTNTHCX2BqU0AMDk3YiaY5ssofMyPVMth5V/qoO0Js+JXMl2JHIwHPRsKNtpIU5WFEL2ZaluzfQZSdMQZ76G9cC2aZvLWJpJTNGx6hB/B+I9bgHWTOec4Ejohx2MDXMB8impzk56Sh2J1fJYY2mc8Bf66bUdlIy2gx1USdyql4z9HSFBxcC/bj+WHRVvAAg2ENih6cXdkIgz3v0ly6UCXy9noyAYaQGXqBoakRzZFLqwRWHNH1Tic/l9M+ixJDQilpM13XMa+Jw3IgHg56T9CfHFqPLKa6puOhpOVp+6q/WnfBRhAou+huNglxMsG9YE982JnceR7ElGYWYt1Ln2mnyA2PblGpVunDrL0b3sYV9Elv+Nrstlxi6VwLvetGJjErSAXavEWvBI6rUU8PHLODkCWX5D84QKQ==" Dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\CID\{45007100-4A00-5000-6F00-380074006A00}\1 = "YHvBfiDx9EmwIx5/keSJzNlKbPnPIibiUA1Wify0ZLcmys2MwE4E2a/rsLNzlUZhAbAK4yTiwjwdi6T+ZB7sidQlOaSC/ePQUQn1/CdJlxIzSJBs6MWjVB515FZ7jSwtINMug7LttQGOciCMqzDOXL4KiVkIn+X4SN3r6Cw1ThHcWppG2EVMjPS7iyVyOPQQ" Dllhost.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\CID\{78006D00-6900-3500-4D00-470059004100} b266716ff41ca7d2a05994174c5f75083081c9dfd5b6fb8abb7f2a7c0e373950.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\CID b266716ff41ca7d2a05994174c5f75083081c9dfd5b6fb8abb7f2a7c0e373950.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\CID\{78006D00-6900-3500-4D00-470059004100}\1 = "Evgbxea2DKZzh/U+YxcVXvD41ENZQmT9blZoTFtPfAWy0sKL5Z4kMHTNTHCX2BqU0AMDk3YiaY5ssofMyPVMth5V/qoO0Js+JXMl2JHIwHPRsKNtpIU5WFEL2ZaluzfQZSdMQZ76G9cC2aZvLWJpJTNGx6hB/B+I9bgHWTOec4Ejohx2MDXMB8impzk56Sh2J1fJYY2mc8Bf66bUdlIy2gx1USdyql4z9HSFBxcC/bj+WHRVvAAg2ENih6cXdkIgz3v0ly6UCXy9noyAYaQGXqBoakRzZFLqwRWHNH1Tic/l9M+ixJDQilpM13XMa+Jw3IgHg56T9CfHFqPLKa6puOhpOVp+6q/WnfBRhAou+huNglxMsG9YE982JnceR7ElGYWYt1Ln2mnyA2PblGpVunDrL0b3sYV9Elv+Nrstlxi6VwLvetGJjErSAXavEWvBI6rUU8PHLODkCWX5D84QKQ==" b266716ff41ca7d2a05994174c5f75083081c9dfd5b6fb8abb7f2a7c0e373950.exe -
Modifies registry key 1 TTPs 1 IoCs
-
NTFS ADS 12 IoCs
Processes:
b266716ff41ca7d2a05994174c5f75083081c9dfd5b6fb8abb7f2a7c0e373950.exeDllhost.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp:{78006D00-6900-3500-4D00-470059004100} b266716ff41ca7d2a05994174c5f75083081c9dfd5b6fb8abb7f2a7c0e373950.exe File created C:\Users\Admin\Documents\My Music:{78006D00-6900-3500-4D00-470059004100} b266716ff41ca7d2a05994174c5f75083081c9dfd5b6fb8abb7f2a7c0e373950.exe File created C:\Users\Admin\Documents\My Music:{45007100-4A00-5000-6F00-380074006A00} Dllhost.exe File created C:\Users\Admin\Documents\My Music:{78006D00-6900-3500-4D00-470059004100} Dllhost.exe File opened for modification C:\odt:{78006D00-6900-3500-4D00-470059004100} Dllhost.exe File created C:\Users\Admin\AppData\Local\Temp\InstallDir:{45007100-4A00-5000-6F00-380074006A00} Dllhost.exe File created C:\odt:{78006D00-6900-3500-4D00-470059004100} b266716ff41ca7d2a05994174c5f75083081c9dfd5b6fb8abb7f2a7c0e373950.exe File created C:\Users\Admin\AppData\Local\Temp:{45007100-4A00-5000-6F00-380074006A00} b266716ff41ca7d2a05994174c5f75083081c9dfd5b6fb8abb7f2a7c0e373950.exe File created C:\Users\Admin\Documents\My Music:{45007100-4A00-5000-6F00-380074006A00} b266716ff41ca7d2a05994174c5f75083081c9dfd5b6fb8abb7f2a7c0e373950.exe File created C:\odt:{45007100-4A00-5000-6F00-380074006A00} b266716ff41ca7d2a05994174c5f75083081c9dfd5b6fb8abb7f2a7c0e373950.exe File created C:\Users\Admin\AppData\Local\Temp\InstallDir:{78006D00-6900-3500-4D00-470059004100} Dllhost.exe File opened for modification C:\odt:{45007100-4A00-5000-6F00-380074006A00} Dllhost.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
Dllhost.exepid process 4896 Dllhost.exe 4896 Dllhost.exe 4896 Dllhost.exe 4896 Dllhost.exe 4896 Dllhost.exe 4896 Dllhost.exe 4896 Dllhost.exe 4896 Dllhost.exe 4896 Dllhost.exe 4896 Dllhost.exe 4896 Dllhost.exe 4896 Dllhost.exe 4896 Dllhost.exe 4896 Dllhost.exe 4896 Dllhost.exe 4896 Dllhost.exe 4896 Dllhost.exe 4896 Dllhost.exe 4896 Dllhost.exe 4896 Dllhost.exe 4896 Dllhost.exe 4896 Dllhost.exe 4896 Dllhost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Dllhost.exedescription pid process Token: SeDebugPrivilege 4896 Dllhost.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
b266716ff41ca7d2a05994174c5f75083081c9dfd5b6fb8abb7f2a7c0e373950.exeDllhost.execmd.exedescription pid process target process PID 2212 wrote to memory of 4896 2212 b266716ff41ca7d2a05994174c5f75083081c9dfd5b6fb8abb7f2a7c0e373950.exe Dllhost.exe PID 2212 wrote to memory of 4896 2212 b266716ff41ca7d2a05994174c5f75083081c9dfd5b6fb8abb7f2a7c0e373950.exe Dllhost.exe PID 2212 wrote to memory of 4896 2212 b266716ff41ca7d2a05994174c5f75083081c9dfd5b6fb8abb7f2a7c0e373950.exe Dllhost.exe PID 4896 wrote to memory of 3080 4896 Dllhost.exe netsh.exe PID 4896 wrote to memory of 3080 4896 Dllhost.exe netsh.exe PID 4896 wrote to memory of 3080 4896 Dllhost.exe netsh.exe PID 4896 wrote to memory of 4840 4896 Dllhost.exe cmd.exe PID 4896 wrote to memory of 4840 4896 Dllhost.exe cmd.exe PID 4896 wrote to memory of 4840 4896 Dllhost.exe cmd.exe PID 4896 wrote to memory of 2696 4896 Dllhost.exe netsh.exe PID 4896 wrote to memory of 2696 4896 Dllhost.exe netsh.exe PID 4896 wrote to memory of 2696 4896 Dllhost.exe netsh.exe PID 4840 wrote to memory of 4616 4840 cmd.exe reg.exe PID 4840 wrote to memory of 4616 4840 cmd.exe reg.exe PID 4840 wrote to memory of 4616 4840 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b266716ff41ca7d2a05994174c5f75083081c9dfd5b6fb8abb7f2a7c0e373950.exe"C:\Users\Admin\AppData\Local\Temp\b266716ff41ca7d2a05994174c5f75083081c9dfd5b6fb8abb7f2a7c0e373950.exe"1⤵
- Checks computer location settings
- Modifies registry class
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallDir\Dllhost.exe"C:\Users\Admin\AppData\Local\Temp\InstallDir\Dllhost.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\InstallDir\Dllhost.exe" "Dllhost.exe" ENABLE3⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- Modifies registry key
-
C:\Windows\SysWOW64\netsh.exenetsh.exe firewall set opmode disable3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Isolated Storage\{45007100-4A00-5000-6F00-380074006A00}Filesize
384B
MD53d89818039ddcebca67f70506b37dc9c
SHA182ecc3edc666019a0be66c9add2b9ea8e8ddfd12
SHA256516937956393d78cde752d6a2835b7098ea725595210394b1c1498eee2206d43
SHA5123e26de541507523d47a75cbacedb965364598bdb6d3fd79fe6cff57a4a8371a593201323bdfd77e731e8352d8a2be643f83f00433f267ad7c96603ede086d615
-
C:\Users\Admin\AppData\Local\Temp\MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\InstallDir\Dllhost.exeFilesize
603KB
MD5202a640b5da9a32d7050cf39eb0f7726
SHA1d499984e6bd951514997ded82485e10844b329f6
SHA256b266716ff41ca7d2a05994174c5f75083081c9dfd5b6fb8abb7f2a7c0e373950
SHA51220d46542201adab3da36a971f35cee594036ec3164bc990f9b7bba3b8a8d82c69e323a7b445b9a4045e4e3266e70e1b885d7c78e30ca34bdb111b2966ddb41c0
-
C:\Users\Admin\AppData\Local\Temp\InstallDir\Dllhost.exeFilesize
603KB
MD5202a640b5da9a32d7050cf39eb0f7726
SHA1d499984e6bd951514997ded82485e10844b329f6
SHA256b266716ff41ca7d2a05994174c5f75083081c9dfd5b6fb8abb7f2a7c0e373950
SHA51220d46542201adab3da36a971f35cee594036ec3164bc990f9b7bba3b8a8d82c69e323a7b445b9a4045e4e3266e70e1b885d7c78e30ca34bdb111b2966ddb41c0
-
C:\odt:{78006D00-6900-3500-4D00-470059004100}Filesize
472B
MD5931d83969d8691ab9c5f5dc8b7ae05c7
SHA1fa91ccfac4ab90c41213ec894a4499622c4927cd
SHA256621d7cdd32efaa9c095f2532802431bd15b8de7851343bdd133f97c213d03fb0
SHA512f67ed3004ec4a5a9d4291df2881612aab49113a6b31366d328b5ff28a9577716b3fb7c72628a2db153fb736603a1ca02e40b1488aeb02fd4eb26d2b53207c7c6
-
memory/2212-130-0x0000000074BC0000-0x0000000075171000-memory.dmpFilesize
5.7MB
-
memory/2696-140-0x0000000000000000-mapping.dmp
-
memory/3080-138-0x0000000000000000-mapping.dmp
-
memory/4616-141-0x0000000000000000-mapping.dmp
-
memory/4840-139-0x0000000000000000-mapping.dmp
-
memory/4896-131-0x0000000000000000-mapping.dmp
-
memory/4896-136-0x0000000074BC0000-0x0000000075171000-memory.dmpFilesize
5.7MB