Analysis
-
max time kernel
136s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20/05/2022, 10:18
Static task
static1
Behavioral task
behavioral1
Sample
moavjcbg.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
moavjcbg.dll
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
moavjcbg.dll
-
Size
87KB
-
MD5
fee171fbd4ec2ef64bd04567a80df805
-
SHA1
2db3c49ec6151c1a3c98a7b92006629741b403b5
-
SHA256
9146be1fc85a94880644670cbf63545efb6db43516d79f42a8792342f684a5ca
-
SHA512
c66a675706a5c06202366ad6ef2a64bb82d033037447bd212ef479694d26ce040874a65a48f6f9af04af87a5bf1c45696fc2806e5095dac91d3d3b189401712c
Score
8/10
Malware Config
Signatures
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ClearGet.tiff => C:\Users\Admin\Pictures\ClearGet.tiff.xtceymt rundll32.exe File renamed C:\Users\Admin\Pictures\ConvertToReceive.png => C:\Users\Admin\Pictures\ConvertToReceive.png.xtceymt rundll32.exe File renamed C:\Users\Admin\Pictures\DisableWait.tif => C:\Users\Admin\Pictures\DisableWait.tif.xtceymt rundll32.exe File renamed C:\Users\Admin\Pictures\ShowSwitch.raw => C:\Users\Admin\Pictures\ShowSwitch.raw.xtceymt rundll32.exe File renamed C:\Users\Admin\Pictures\UseMove.raw => C:\Users\Admin\Pictures\UseMove.raw.xtceymt rundll32.exe File renamed C:\Users\Admin\Pictures\BackupExport.tif => C:\Users\Admin\Pictures\BackupExport.tif.xtceymt rundll32.exe File opened for modification C:\Users\Admin\Pictures\ClearGet.tiff rundll32.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process PID 1748 set thread context of 0 1748 rundll32.exe PID 1748 set thread context of 0 1748 rundll32.exe PID 1748 set thread context of 0 1748 rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1688 1748 WerFault.exe 22 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000850f07ecb424934d8f5a48a59e73cec00000000002000000000010660000000100002000000083477ece1959d51ee1bb7d7211a80a6c673951d08c26ab505daae03dc582044a000000000e80000000020000200000005da968d0aad832c954a069908302ecaa6a2128bd8226b4aa387fac47daa7212590000000f659b4c7c6b9de231f44ac5682d27d51ff74cf0ce025690d8ba610ff50c4a8df4b01d566cccd7394e4cfc2f9a15e19f552ab601c42095d249d79550342d5bcf45f0f32cda35b8aa96bc4d8cb933a68164c8914c876cdba10a7640e62abc1767ba88e2abd517361da40acb247b63f9c3135fcc5fa3dd366e70fdf13e492d2fc4fc41f5ba9092f4294d8f95b786672f75940000000e628e974678ec7a7b7bc128c3c8808c1803d2c3ab9177f5b860e62beb9da499ded72eed5749a64c1c1c7174251ee90b8f874e9f22656005ad7bba92b993f2f2d iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "359814106" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000850f07ecb424934d8f5a48a59e73cec000000000020000000000106600000001000020000000ec39fac1a862844fea1bceeb27e0cd5ec6a65a5d54b7c4ba031f6bff3b305147000000000e80000000020000200000001c79cff6ab69dcaf55f08c1b3eded1baa6e189fdea35232281897b910ed1798020000000481b0379cd764485ee17c11057cced090b8ab58e887d96d48bfa4aa3d27340574000000064480466434d0a3a0e2f423787e1f34a199998add3f5b6b7b73f88417e67be626189802916892f01b403b53d3f0485b452f680ee4737cf3e0f8f38971aa509b9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 306d15dc436cd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{02323341-D837-11EC-838E-726C518001C0} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1748 rundll32.exe 1748 rundll32.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 1748 rundll32.exe 1748 rundll32.exe 1748 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeShutdownPrivilege 1264 Process not Found Token: SeShutdownPrivilege 1264 Process not Found Token: SeShutdownPrivilege 1264 Process not Found Token: SeShutdownPrivilege 1264 Process not Found Token: SeShutdownPrivilege 1264 Process not Found Token: SeShutdownPrivilege 1264 Process not Found -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1752 iexplore.exe 1264 Process not Found 1264 Process not Found -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1264 Process not Found 1264 Process not Found 1264 Process not Found -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1752 iexplore.exe 1752 iexplore.exe 1288 IEXPLORE.EXE 1288 IEXPLORE.EXE 1288 IEXPLORE.EXE 1288 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1264 Process not Found -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1748 wrote to memory of 1680 1748 rundll32.exe 28 PID 1748 wrote to memory of 1680 1748 rundll32.exe 28 PID 1748 wrote to memory of 1680 1748 rundll32.exe 28 PID 1748 wrote to memory of 1688 1748 rundll32.exe 29 PID 1748 wrote to memory of 1688 1748 rundll32.exe 29 PID 1748 wrote to memory of 1688 1748 rundll32.exe 29 PID 1680 wrote to memory of 1752 1680 cmd.exe 31 PID 1680 wrote to memory of 1752 1680 cmd.exe 31 PID 1680 wrote to memory of 1752 1680 cmd.exe 31 PID 1752 wrote to memory of 1288 1752 iexplore.exe 33 PID 1752 wrote to memory of 1288 1752 iexplore.exe 33 PID 1752 wrote to memory of 1288 1752 iexplore.exe 33 PID 1752 wrote to memory of 1288 1752 iexplore.exe 33
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\moavjcbg.dll,#11⤵
- Modifies extensions of user files
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\system32\cmd.execmd /c "start http://fed89e002extceymt.rowarea.info/xtceymt^&1^&40102110^&73^&421^&122⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://fed89e002extceymt.rowarea.info/xtceymt&1&40102110&73&421&123⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1288
-
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1748 -s 7562⤵
- Program crash
PID:1688
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
604B
MD56abedc5d9979e5bd23a83d9fb20823c1
SHA1cc28e0216590dfca0b21a14c020a99b5bacb0840
SHA256b37f854334acf8f57a582ebc125ef1c2f99bca2da15f320fad0133cf3d840ee1
SHA512befaa6e22bec97d56489814b29496b921a466f046cf3de654bb261548ed20c2b262ba4ea6140aef46cd34dbc83fdc5dbd0df2225a584373e48cfa393f4b6bdb9