Analysis
-
max time kernel
103s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
15-06-2022 05:02
Static task
static1
Behavioral task
behavioral1
Sample
5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe
-
Size
2.4MB
-
MD5
2a9b350724cf795e51170276844cbe16
-
SHA1
b88f6beb6f101ca31239ea5616d0ce663e457284
-
SHA256
5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42
-
SHA512
d717db38aca3329d92cc81ce3fb737b0de2bd837e55e6ef11661b57e2d5f7b83f93e38a04911525106e893eae4fd7099db384b88ad4d83f7e80baaca25c58acd
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4160-130-0x00000000005D0000-0x0000000000D5A000-memory.dmp upx behavioral2/memory/4160-131-0x00000000005D0000-0x0000000000D5A000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\adobe.com 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "48" 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\auth.services.adobe.com\ = "48" 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe = "11001" 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DOMStorage\adobe.com 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DOMStorage\auth.services.adobe.com 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\adobe.com\Total = "48" 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\adobe.com\NumberOfSubdomains = "1" 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exepid process 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
Processes:
5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exedescription pid process Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe Token: SeIncreaseQuotaPrivilege 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exepid process 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe 4160 5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe"C:\Users\Admin\AppData\Local\Temp\5f86da7a806fe5dcaf4832dd2b57ba4dd87655a39ff122c1865502430d3b2a42.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx