Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
07-06-2022 17:18
Static task
static1
Behavioral task
behavioral1
Sample
1be19ee0bb481b039d688c6700f2fb0a147c45e9d6930cf55fa6b7caae815cef.exe
Resource
win7-20220414-en
0 signatures
0 seconds
General
-
Target
1be19ee0bb481b039d688c6700f2fb0a147c45e9d6930cf55fa6b7caae815cef.exe
-
Size
213KB
-
MD5
5f30f7e4864498b10c78534c30e641e5
-
SHA1
25db2e2fc989b189cf55b65eecb40d0907eb8285
-
SHA256
1be19ee0bb481b039d688c6700f2fb0a147c45e9d6930cf55fa6b7caae815cef
-
SHA512
7b97f25dc39ec7a83fee4cf85146f229e0b5fb31cf57723addd6f946c70f5b4a8b95f8ed0709f0fa54708a3c9afad9ab3f10739373cebbe2df35476f581c7c7f
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
replpolic.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat replpolic.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 18 IoCs
Processes:
replpolic.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5D012ADD-B192-4DA8-B7A5-1905B2B85DC0}\WpadNetworkName = "Network 3" replpolic.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-bc-19-76-0d-74\WpadDecisionReason = "1" replpolic.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections replpolic.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5D012ADD-B192-4DA8-B7A5-1905B2B85DC0}\WpadDecisionReason = "1" replpolic.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5D012ADD-B192-4DA8-B7A5-1905B2B85DC0}\WpadDecision = "0" replpolic.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0077000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 replpolic.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5D012ADD-B192-4DA8-B7A5-1905B2B85DC0}\WpadDecisionTime = 80cbf609af7ad801 replpolic.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-bc-19-76-0d-74\WpadDecision = "0" replpolic.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 replpolic.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings replpolic.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5D012ADD-B192-4DA8-B7A5-1905B2B85DC0} replpolic.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad replpolic.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-bc-19-76-0d-74 replpolic.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5D012ADD-B192-4DA8-B7A5-1905B2B85DC0}\02-bc-19-76-0d-74 replpolic.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-bc-19-76-0d-74\WpadDecisionTime = 80cbf609af7ad801 replpolic.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings replpolic.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" replpolic.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 replpolic.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
1be19ee0bb481b039d688c6700f2fb0a147c45e9d6930cf55fa6b7caae815cef.exe1be19ee0bb481b039d688c6700f2fb0a147c45e9d6930cf55fa6b7caae815cef.exereplpolic.exereplpolic.exepid process 1580 1be19ee0bb481b039d688c6700f2fb0a147c45e9d6930cf55fa6b7caae815cef.exe 1588 1be19ee0bb481b039d688c6700f2fb0a147c45e9d6930cf55fa6b7caae815cef.exe 2040 replpolic.exe 2036 replpolic.exe 2036 replpolic.exe 2036 replpolic.exe 2036 replpolic.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
1be19ee0bb481b039d688c6700f2fb0a147c45e9d6930cf55fa6b7caae815cef.exepid process 1588 1be19ee0bb481b039d688c6700f2fb0a147c45e9d6930cf55fa6b7caae815cef.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
1be19ee0bb481b039d688c6700f2fb0a147c45e9d6930cf55fa6b7caae815cef.exereplpolic.exedescription pid process target process PID 1580 wrote to memory of 1588 1580 1be19ee0bb481b039d688c6700f2fb0a147c45e9d6930cf55fa6b7caae815cef.exe 1be19ee0bb481b039d688c6700f2fb0a147c45e9d6930cf55fa6b7caae815cef.exe PID 1580 wrote to memory of 1588 1580 1be19ee0bb481b039d688c6700f2fb0a147c45e9d6930cf55fa6b7caae815cef.exe 1be19ee0bb481b039d688c6700f2fb0a147c45e9d6930cf55fa6b7caae815cef.exe PID 1580 wrote to memory of 1588 1580 1be19ee0bb481b039d688c6700f2fb0a147c45e9d6930cf55fa6b7caae815cef.exe 1be19ee0bb481b039d688c6700f2fb0a147c45e9d6930cf55fa6b7caae815cef.exe PID 1580 wrote to memory of 1588 1580 1be19ee0bb481b039d688c6700f2fb0a147c45e9d6930cf55fa6b7caae815cef.exe 1be19ee0bb481b039d688c6700f2fb0a147c45e9d6930cf55fa6b7caae815cef.exe PID 2040 wrote to memory of 2036 2040 replpolic.exe replpolic.exe PID 2040 wrote to memory of 2036 2040 replpolic.exe replpolic.exe PID 2040 wrote to memory of 2036 2040 replpolic.exe replpolic.exe PID 2040 wrote to memory of 2036 2040 replpolic.exe replpolic.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1be19ee0bb481b039d688c6700f2fb0a147c45e9d6930cf55fa6b7caae815cef.exe"C:\Users\Admin\AppData\Local\Temp\1be19ee0bb481b039d688c6700f2fb0a147c45e9d6930cf55fa6b7caae815cef.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1be19ee0bb481b039d688c6700f2fb0a147c45e9d6930cf55fa6b7caae815cef.exe"C:\Users\Admin\AppData\Local\Temp\1be19ee0bb481b039d688c6700f2fb0a147c45e9d6930cf55fa6b7caae815cef.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\replpolic.exe"C:\Windows\SysWOW64\replpolic.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\replpolic.exe"C:\Windows\SysWOW64\replpolic.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1580-65-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1580-58-0x0000000000270000-0x000000000028A000-memory.dmpFilesize
104KB
-
memory/1580-54-0x0000000000270000-0x000000000028A000-memory.dmpFilesize
104KB
-
memory/1580-67-0x0000000000290000-0x00000000002A0000-memory.dmpFilesize
64KB
-
memory/1580-66-0x0000000000250000-0x000000000026A000-memory.dmpFilesize
104KB
-
memory/1588-68-0x00000000001B0000-0x00000000001CA000-memory.dmpFilesize
104KB
-
memory/1588-64-0x0000000000250000-0x000000000026A000-memory.dmpFilesize
104KB
-
memory/1588-60-0x0000000000250000-0x000000000026A000-memory.dmpFilesize
104KB
-
memory/1588-59-0x0000000000000000-mapping.dmp
-
memory/1588-69-0x00000000003E0000-0x00000000003F0000-memory.dmpFilesize
64KB
-
memory/1588-70-0x0000000076811000-0x0000000076813000-memory.dmpFilesize
8KB
-
memory/1588-83-0x00000000001B0000-0x00000000001CA000-memory.dmpFilesize
104KB
-
memory/2036-76-0x0000000000000000-mapping.dmp
-
memory/2036-84-0x0000000000250000-0x000000000026A000-memory.dmpFilesize
104KB
-
memory/2036-86-0x0000000000250000-0x000000000026A000-memory.dmpFilesize
104KB
-
memory/2040-82-0x0000000000250000-0x000000000026A000-memory.dmpFilesize
104KB