Analysis
-
max time kernel
139s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
15-06-2022 01:03
Static task
static1
Behavioral task
behavioral1
Sample
2bc2ad205b03b5b9126bed5ed97688638b3a0b062e6486e0cb00a87193c46075.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2bc2ad205b03b5b9126bed5ed97688638b3a0b062e6486e0cb00a87193c46075.exe
Resource
win10v2004-20220414-en
General
-
Target
2bc2ad205b03b5b9126bed5ed97688638b3a0b062e6486e0cb00a87193c46075.exe
-
Size
225KB
-
MD5
c2dfa7e4e4d999e7fc8158fbe575d4a3
-
SHA1
89161f9448cd475b940c865a6e0f09d00af024ea
-
SHA256
2bc2ad205b03b5b9126bed5ed97688638b3a0b062e6486e0cb00a87193c46075
-
SHA512
8c1347298223db90aa99fe3d0bba0a716c3ff0ce02fa9e5c7a7d54ee97c4b5cf7871ba172e0f92ba2a2ecbc77af67026fab89cfbb8dad2f227d6b82922bce9d1
Malware Config
Signatures
-
Drops file in System32 directory 3 IoCs
Processes:
defragwlan.exedefragwlan.exedescription ioc process File created C:\Windows\SysWOW64\ExwgBDryShtwACnd defragwlan.exe File created C:\Windows\SysWOW64\ExwgBDryShtwACnd defragwlan.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat defragwlan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 33 IoCs
Processes:
defragwlan.exedefragwlan.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" defragwlan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings defragwlan.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 defragwlan.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{693DE326-BD1C-4F4B-9B63-54080522E4A1}\WpadDecisionReason = "1" defragwlan.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-50-bb-16-20-51\WpadDecision = "0" defragwlan.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{693DE326-BD1C-4F4B-9B63-54080522E4A1}\WpadDecisionTime = 70fec0a36880d801 defragwlan.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix defragwlan.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 010000000000000010da85546880d801 defragwlan.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings defragwlan.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 defragwlan.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 defragwlan.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{99FD978C-D287-4F50-827F-B2C658EDA8E7} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 0100000000000000501781546880d801 defragwlan.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 defragwlan.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{693DE326-BD1C-4F4B-9B63-54080522E4A1}\WpadDecision = "0" defragwlan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{693DE326-BD1C-4F4B-9B63-54080522E4A1}\a2-50-bb-16-20-51 defragwlan.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-50-bb-16-20-51\WpadDetectedUrl defragwlan.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 0100000000000000b07883546880d801 defragwlan.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{920E6DB1-9907-4370-B3A0-BAFC03D81399} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 0100000000000000b07883546880d801 defragwlan.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{693DE326-BD1C-4F4B-9B63-54080522E4A1}\WpadNetworkName = "Network 3" defragwlan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-50-bb-16-20-51 defragwlan.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-50-bb-16-20-51\WpadDecisionTime = 70fec0a36880d801 defragwlan.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 0100000000000000501781546880d801 defragwlan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad defragwlan.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{693DE326-BD1C-4F4B-9B63-54080522E4A1}\WpadDecisionTime = 9053675b6880d801 defragwlan.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" defragwlan.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{08244EE6-92F0-47F2-9FC9-929BAA2E7235} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 0100000000000000d09c8a546880d801 defragwlan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections defragwlan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached defragwlan.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-50-bb-16-20-51\WpadDecisionReason = "1" defragwlan.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{693DE326-BD1C-4F4B-9B63-54080522E4A1} defragwlan.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" defragwlan.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-50-bb-16-20-51\WpadDecisionTime = 9053675b6880d801 defragwlan.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{16F3DD56-1AF5-4347-846D-7C10C4192619} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 0100000000000000b07883546880d801 defragwlan.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
defragwlan.exepid process 1732 defragwlan.exe 1732 defragwlan.exe 1732 defragwlan.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
2bc2ad205b03b5b9126bed5ed97688638b3a0b062e6486e0cb00a87193c46075.exepid process 1912 2bc2ad205b03b5b9126bed5ed97688638b3a0b062e6486e0cb00a87193c46075.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
2bc2ad205b03b5b9126bed5ed97688638b3a0b062e6486e0cb00a87193c46075.exedefragwlan.exedescription pid process target process PID 1100 wrote to memory of 1912 1100 2bc2ad205b03b5b9126bed5ed97688638b3a0b062e6486e0cb00a87193c46075.exe 2bc2ad205b03b5b9126bed5ed97688638b3a0b062e6486e0cb00a87193c46075.exe PID 1100 wrote to memory of 1912 1100 2bc2ad205b03b5b9126bed5ed97688638b3a0b062e6486e0cb00a87193c46075.exe 2bc2ad205b03b5b9126bed5ed97688638b3a0b062e6486e0cb00a87193c46075.exe PID 1100 wrote to memory of 1912 1100 2bc2ad205b03b5b9126bed5ed97688638b3a0b062e6486e0cb00a87193c46075.exe 2bc2ad205b03b5b9126bed5ed97688638b3a0b062e6486e0cb00a87193c46075.exe PID 1100 wrote to memory of 1912 1100 2bc2ad205b03b5b9126bed5ed97688638b3a0b062e6486e0cb00a87193c46075.exe 2bc2ad205b03b5b9126bed5ed97688638b3a0b062e6486e0cb00a87193c46075.exe PID 1748 wrote to memory of 1732 1748 defragwlan.exe defragwlan.exe PID 1748 wrote to memory of 1732 1748 defragwlan.exe defragwlan.exe PID 1748 wrote to memory of 1732 1748 defragwlan.exe defragwlan.exe PID 1748 wrote to memory of 1732 1748 defragwlan.exe defragwlan.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bc2ad205b03b5b9126bed5ed97688638b3a0b062e6486e0cb00a87193c46075.exe"C:\Users\Admin\AppData\Local\Temp\2bc2ad205b03b5b9126bed5ed97688638b3a0b062e6486e0cb00a87193c46075.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2bc2ad205b03b5b9126bed5ed97688638b3a0b062e6486e0cb00a87193c46075.exe"C:\Users\Admin\AppData\Local\Temp\2bc2ad205b03b5b9126bed5ed97688638b3a0b062e6486e0cb00a87193c46075.exe"2⤵
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\defragwlan.exeC:\Windows\SysWOW64\defragwlan.exe1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\defragwlan.exe"C:\Windows\SysWOW64\defragwlan.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1100-54-0x0000000074B51000-0x0000000074B53000-memory.dmpFilesize
8KB
-
memory/1100-55-0x0000000000450000-0x000000000045D000-memory.dmpFilesize
52KB
-
memory/1100-59-0x0000000000450000-0x000000000045D000-memory.dmpFilesize
52KB
-
memory/1100-67-0x0000000000440000-0x000000000044D000-memory.dmpFilesize
52KB
-
memory/1732-83-0x0000000000110000-0x000000000011D000-memory.dmpFilesize
52KB
-
memory/1732-81-0x00000000002B0000-0x00000000002BD000-memory.dmpFilesize
52KB
-
memory/1732-77-0x00000000002B0000-0x00000000002BD000-memory.dmpFilesize
52KB
-
memory/1732-75-0x0000000000000000-mapping.dmp
-
memory/1748-74-0x0000000000500000-0x000000000050D000-memory.dmpFilesize
52KB
-
memory/1748-70-0x0000000000500000-0x000000000050D000-memory.dmpFilesize
52KB
-
memory/1748-82-0x00000000002F0000-0x00000000002FD000-memory.dmpFilesize
52KB
-
memory/1912-68-0x0000000000160000-0x000000000016D000-memory.dmpFilesize
52KB
-
memory/1912-66-0x00000000001F0000-0x00000000001FD000-memory.dmpFilesize
52KB
-
memory/1912-62-0x00000000001F0000-0x00000000001FD000-memory.dmpFilesize
52KB
-
memory/1912-60-0x0000000000000000-mapping.dmp