Analysis
-
max time kernel
176s -
max time network
190s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
04-06-2022 16:13
Static task
static1
Behavioral task
behavioral1
Sample
0f416f2a59558774bf4f6799231c2b441abae078912c3f2324db8c1e5b4ef5c8.exe
Resource
win7-20220414-en
General
-
Target
0f416f2a59558774bf4f6799231c2b441abae078912c3f2324db8c1e5b4ef5c8.exe
-
Size
556KB
-
MD5
60985097eabef1b073f9a6dd7d6b83a7
-
SHA1
c2c098460122d7d8f845b53ccdc38a094af520a3
-
SHA256
0f416f2a59558774bf4f6799231c2b441abae078912c3f2324db8c1e5b4ef5c8
-
SHA512
436823e24970d5632b1d26fd358887d3af1a5feeb2c64ff103140eae5eb3a423573315241f24adfb7128598de2f99dfea4b8c5dd7e0e02ff3cc876c5f584c837
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
routedlanes.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat routedlanes.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 18 IoCs
Processes:
routedlanes.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections routedlanes.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 routedlanes.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings routedlanes.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CAAA66A9-043B-41BA-AD09-E1C42E7F51B6} routedlanes.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CAAA66A9-043B-41BA-AD09-E1C42E7F51B6}\WpadDecisionTime = c0e60ca16c78d801 routedlanes.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CAAA66A9-043B-41BA-AD09-E1C42E7F51B6}\WpadDecision = "0" routedlanes.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-2d-3c-73-4e-8f\WpadDecision = "0" routedlanes.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0096000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 routedlanes.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CAAA66A9-043B-41BA-AD09-E1C42E7F51B6}\WpadDecisionReason = "1" routedlanes.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CAAA66A9-043B-41BA-AD09-E1C42E7F51B6}\WpadNetworkName = "Network 2" routedlanes.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-2d-3c-73-4e-8f routedlanes.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CAAA66A9-043B-41BA-AD09-E1C42E7F51B6}\be-2d-3c-73-4e-8f routedlanes.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-2d-3c-73-4e-8f\WpadDecisionTime = c0e60ca16c78d801 routedlanes.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings routedlanes.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 routedlanes.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad routedlanes.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-2d-3c-73-4e-8f\WpadDecisionReason = "1" routedlanes.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" routedlanes.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
0f416f2a59558774bf4f6799231c2b441abae078912c3f2324db8c1e5b4ef5c8.exe0f416f2a59558774bf4f6799231c2b441abae078912c3f2324db8c1e5b4ef5c8.exeroutedlanes.exeroutedlanes.exepid process 1776 0f416f2a59558774bf4f6799231c2b441abae078912c3f2324db8c1e5b4ef5c8.exe 1044 0f416f2a59558774bf4f6799231c2b441abae078912c3f2324db8c1e5b4ef5c8.exe 2024 routedlanes.exe 1932 routedlanes.exe 1932 routedlanes.exe 1932 routedlanes.exe 1932 routedlanes.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
0f416f2a59558774bf4f6799231c2b441abae078912c3f2324db8c1e5b4ef5c8.exepid process 1044 0f416f2a59558774bf4f6799231c2b441abae078912c3f2324db8c1e5b4ef5c8.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
0f416f2a59558774bf4f6799231c2b441abae078912c3f2324db8c1e5b4ef5c8.exeroutedlanes.exedescription pid process target process PID 1776 wrote to memory of 1044 1776 0f416f2a59558774bf4f6799231c2b441abae078912c3f2324db8c1e5b4ef5c8.exe 0f416f2a59558774bf4f6799231c2b441abae078912c3f2324db8c1e5b4ef5c8.exe PID 1776 wrote to memory of 1044 1776 0f416f2a59558774bf4f6799231c2b441abae078912c3f2324db8c1e5b4ef5c8.exe 0f416f2a59558774bf4f6799231c2b441abae078912c3f2324db8c1e5b4ef5c8.exe PID 1776 wrote to memory of 1044 1776 0f416f2a59558774bf4f6799231c2b441abae078912c3f2324db8c1e5b4ef5c8.exe 0f416f2a59558774bf4f6799231c2b441abae078912c3f2324db8c1e5b4ef5c8.exe PID 1776 wrote to memory of 1044 1776 0f416f2a59558774bf4f6799231c2b441abae078912c3f2324db8c1e5b4ef5c8.exe 0f416f2a59558774bf4f6799231c2b441abae078912c3f2324db8c1e5b4ef5c8.exe PID 2024 wrote to memory of 1932 2024 routedlanes.exe routedlanes.exe PID 2024 wrote to memory of 1932 2024 routedlanes.exe routedlanes.exe PID 2024 wrote to memory of 1932 2024 routedlanes.exe routedlanes.exe PID 2024 wrote to memory of 1932 2024 routedlanes.exe routedlanes.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f416f2a59558774bf4f6799231c2b441abae078912c3f2324db8c1e5b4ef5c8.exe"C:\Users\Admin\AppData\Local\Temp\0f416f2a59558774bf4f6799231c2b441abae078912c3f2324db8c1e5b4ef5c8.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0f416f2a59558774bf4f6799231c2b441abae078912c3f2324db8c1e5b4ef5c8.exe"C:\Users\Admin\AppData\Local\Temp\0f416f2a59558774bf4f6799231c2b441abae078912c3f2324db8c1e5b4ef5c8.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\routedlanes.exe"C:\Windows\SysWOW64\routedlanes.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\routedlanes.exe"C:\Windows\SysWOW64\routedlanes.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1044-69-0x0000000000260000-0x0000000000277000-memory.dmpFilesize
92KB
-
memory/1044-62-0x0000000000280000-0x0000000000297000-memory.dmpFilesize
92KB
-
memory/1044-86-0x0000000000260000-0x0000000000277000-memory.dmpFilesize
92KB
-
memory/1044-60-0x0000000000000000-mapping.dmp
-
memory/1044-70-0x00000000002E0000-0x00000000002F0000-memory.dmpFilesize
64KB
-
memory/1044-66-0x0000000000280000-0x0000000000297000-memory.dmpFilesize
92KB
-
memory/1776-67-0x00000000002D0000-0x00000000002E7000-memory.dmpFilesize
92KB
-
memory/1776-54-0x0000000075DE1000-0x0000000075DE3000-memory.dmpFilesize
8KB
-
memory/1776-59-0x00000000002F0000-0x0000000000307000-memory.dmpFilesize
92KB
-
memory/1776-55-0x00000000002F0000-0x0000000000307000-memory.dmpFilesize
92KB
-
memory/1776-68-0x00000000003D0000-0x00000000003E0000-memory.dmpFilesize
64KB
-
memory/1932-89-0x00000000004B0000-0x00000000004C7000-memory.dmpFilesize
92KB
-
memory/1932-77-0x0000000000000000-mapping.dmp
-
memory/1932-79-0x00000000004D0000-0x00000000004E7000-memory.dmpFilesize
92KB
-
memory/1932-88-0x00000000003F0000-0x0000000000400000-memory.dmpFilesize
64KB
-
memory/1932-87-0x00000000004B0000-0x00000000004C7000-memory.dmpFilesize
92KB
-
memory/1932-83-0x00000000004D0000-0x00000000004E7000-memory.dmpFilesize
92KB
-
memory/2024-72-0x00000000004E0000-0x00000000004F7000-memory.dmpFilesize
92KB
-
memory/2024-84-0x00000000004B0000-0x00000000004C7000-memory.dmpFilesize
92KB
-
memory/2024-85-0x00000000003F0000-0x0000000000400000-memory.dmpFilesize
64KB
-
memory/2024-76-0x00000000004E0000-0x00000000004F7000-memory.dmpFilesize
92KB