Analysis
-
max time kernel
91s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24-05-2022 22:38
Static task
static1
Behavioral task
behavioral1
Sample
999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe
Resource
win10v2004-20220414-en
General
-
Target
999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe
-
Size
1.2MB
-
MD5
da02266f9b13ebae7a39d285ec681a84
-
SHA1
93c2b86b4411c97960a02d53f5221fdbd44b0a47
-
SHA256
999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84
-
SHA512
fbc6f710d921694855aaf7a22c38c81ef4f74441c85ce261e85cafe5021497adb738c3ff3a8b1a04ae583ff8d9f9d2e00842680798a1d63dd85cd7fce8fecea4
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exeBugreport-328132.dllpid process 3356 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe 4256 Bugreport-328132.dll -
Processes:
resource yara_rule behavioral2/memory/3872-130-0x0000000002800000-0x0000000002872000-memory.dmp upx behavioral2/memory/3872-131-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3872-132-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3872-133-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3872-135-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3872-137-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3872-139-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3872-141-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3872-143-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3872-145-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3872-147-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3872-149-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3872-151-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3872-153-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3872-155-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3872-157-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3872-159-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3872-161-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3872-163-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3872-165-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3872-167-0x0000000002800000-0x0000000002872000-memory.dmp upx behavioral2/memory/3872-169-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3872-171-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3872-173-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/3872-175-0x0000000010000000-0x000000001003E000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe upx behavioral2/memory/3356-178-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3356-180-0x0000000010000000-0x000000001003F000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe upx behavioral2/memory/3356-181-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3356-183-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3356-185-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3356-187-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3356-189-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3356-191-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3356-193-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3356-195-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3356-197-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3356-223-0x0000000010000000-0x000000001003F000-memory.dmp upx behavioral2/memory/3356-224-0x00000000026F0000-0x0000000002762000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exedescription ioc process File opened for modification \??\PhysicalDrive0 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10" 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe = "11001" 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe = "1" 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\International\CpMRU 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exepid process 3872 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe 3872 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe 3356 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe 3356 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe -
Suspicious behavior: RenamesItself 2 IoCs
Processes:
999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exepid process 3872 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe 3872 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exeBugreport-328132.dllpid process 3872 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe 3872 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe 3872 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe 3356 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe 3356 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe 3356 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe 3356 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe 3356 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe 3356 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe 4256 Bugreport-328132.dll -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exedescription pid process target process PID 3872 wrote to memory of 3356 3872 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe PID 3872 wrote to memory of 3356 3872 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe PID 3872 wrote to memory of 3356 3872 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe PID 3356 wrote to memory of 4256 3356 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe Bugreport-328132.dll PID 3356 wrote to memory of 4256 3356 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe Bugreport-328132.dll PID 3356 wrote to memory of 4256 3356 999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe Bugreport-328132.dll
Processes
-
C:\Users\Admin\AppData\Local\Temp\999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe"C:\Users\Admin\AppData\Local\Temp\999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe"1⤵
- Checks computer location settings
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe"C:\Users\Admin\AppData\Local\Temp\999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe" ÃüÁîÆô¶¯2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\data\Bugreport-328132.dllC:\Users\Admin\AppData\Local\Temp\data\Bugreport-328132.dll Bugreport %E8%AF%84%E8%AE%BA%E7%82%B9%203⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4256
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe
Filesize1.2MB
MD526b22e9b633e2daa24920abf1de95bfa
SHA175c32d4ea46d55ef222df763b2d15d8e6b7fe06d
SHA2566a6e9e5de20f791233771a9a365c0432bc5da05021d81a2d4994659d86508d59
SHA51244087d6f545fe1a3c634b485ae12c7f8fe273cec92d53915064d169c7e3943a9d147d7976ff186a74307a57356270f550381cdb87c9cce2bcbc79128812d7adb
-
C:\Users\Admin\AppData\Local\Temp\999d9587fb9831e06f376b9054c641fc31b67096b9c9f859793b9cbc902acf84.exe
Filesize1.2MB
MD526b22e9b633e2daa24920abf1de95bfa
SHA175c32d4ea46d55ef222df763b2d15d8e6b7fe06d
SHA2566a6e9e5de20f791233771a9a365c0432bc5da05021d81a2d4994659d86508d59
SHA51244087d6f545fe1a3c634b485ae12c7f8fe273cec92d53915064d169c7e3943a9d147d7976ff186a74307a57356270f550381cdb87c9cce2bcbc79128812d7adb
-
Filesize
164KB
MD5f0c0cd672a9505562f7ec727819c4867
SHA1b10d3556839c6ca26728b621383ec1624fe84489
SHA25628408ca1e4131fbf38a21b7d34c5aa52d8787d619dfaa552e1d2f886b2176457
SHA5128e3e82f8d53eb9ed26779d1ef43e38938c16255c103ef46c4a66cf300007def6146ed0b600a19dcdf27bc13368816ad47bf3e818d7da51ab141050f67d74746b
-
Filesize
164KB
MD5f0c0cd672a9505562f7ec727819c4867
SHA1b10d3556839c6ca26728b621383ec1624fe84489
SHA25628408ca1e4131fbf38a21b7d34c5aa52d8787d619dfaa552e1d2f886b2176457
SHA5128e3e82f8d53eb9ed26779d1ef43e38938c16255c103ef46c4a66cf300007def6146ed0b600a19dcdf27bc13368816ad47bf3e818d7da51ab141050f67d74746b
-
Filesize
81B
MD5bf0aa65977e52e278da721d998aca638
SHA196b55bdd93ba157b07be7da187a9388d5823da21
SHA25663a82471262255e032ca59edc9939994aadafdc2f0092dde45b780a4aff5d9cd
SHA512b7b00ed01ba1dbb02bcdec7863afc9edc7a19141ffbf036cf5935215920830b98167b8eb5677cf43efecb9b9c0ec3f451d3c9139daf58c591b3156c690c13292