Analysis
- max time kernel
136s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
16/06/2022, 04:49
Static task
static1
Behavioral task
behavioral1
Sample
27721c21711b0a8f2ae1d1e1187cf7f61db114255c824d4f26609f291ef35f49.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
- Target 27721c21711b0a8f2ae1d1e1187cf7f61db114255c824d4f26609f291ef35f49.exe
- Size 271KB
- Sample220616-ffz1saegd9
- SHA256 27721c21711b0a8f2ae1d1e1187cf7f61db114255c824d4f26609f291ef35f49
- MD5 9ffa193108a51cbc901ffb13a07d70a8
- SHA1 7e74cc4561d7b6acd8a5f82e8ed0d0a71813b434
- SHA512 99d0d7cf9e979e6c2ba3eaa9f0d12b1f665feca0eaf07d18316e3ff25acf0f372717eb648fd734fa766de83b0a38662275e68a01eb91bcc110ba7d733818c1d4
- MD5 SHA1 SHA512
Malware Config
Signatures
- Modifies firewall policy service 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile explorer.exe - Executes dropped EXE 1 IoCs
pid Process 4600 Temprihanna.exe - Sets file execution options in registry 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1s57793q51.exe\DisableExceptionChainValidation Temprihanna.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "sdebmp.exe" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1s57793q51.exe Temprihanna.exe - Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation 27721c21711b0a8f2ae1d1e1187cf7f61db114255c824d4f26609f291ef35f49.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Importan Updatre 3.0 = "C:\\ProgramData\\Importan Updatre 3.0\\1s57793q51.exe" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Importan Updatre 3.0 = "\"C:\\ProgramData\\Importan Updatre 3.0\\1s57793q51.exe\"" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce explorer.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Temprihanna.exe - Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini 27721c21711b0a8f2ae1d1e1187cf7f61db114255c824d4f26609f291ef35f49.exe File opened for modification C:\Windows\assembly\Desktop.ini 27721c21711b0a8f2ae1d1e1187cf7f61db114255c824d4f26609f291ef35f49.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
pid Process 4600 Temprihanna.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly 27721c21711b0a8f2ae1d1e1187cf7f61db114255c824d4f26609f291ef35f49.exe File created C:\Windows\assembly\Desktop.ini 27721c21711b0a8f2ae1d1e1187cf7f61db114255c824d4f26609f291ef35f49.exe File opened for modification C:\Windows\assembly\Desktop.ini 27721c21711b0a8f2ae1d1e1187cf7f61db114255c824d4f26609f291ef35f49.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 2380 4808 WerFault.exe 84 - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Temprihanna.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Temprihanna.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer explorer.exe - Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" explorer.exe - Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe 4808 explorer.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 4600 Temprihanna.exe 4600 Temprihanna.exe - Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 3396 27721c21711b0a8f2ae1d1e1187cf7f61db114255c824d4f26609f291ef35f49.exe Token: 33 3396 27721c21711b0a8f2ae1d1e1187cf7f61db114255c824d4f26609f291ef35f49.exe Token: SeIncBasePriorityPrivilege 3396 27721c21711b0a8f2ae1d1e1187cf7f61db114255c824d4f26609f291ef35f49.exe Token: SeDebugPrivilege 4600 Temprihanna.exe Token: SeRestorePrivilege 4600 Temprihanna.exe Token: SeBackupPrivilege 4600 Temprihanna.exe Token: SeLoadDriverPrivilege 4600 Temprihanna.exe Token: SeCreatePagefilePrivilege 4600 Temprihanna.exe Token: SeShutdownPrivilege 4600 Temprihanna.exe Token: SeTakeOwnershipPrivilege 4600 Temprihanna.exe Token: SeChangeNotifyPrivilege 4600 Temprihanna.exe Token: SeCreateTokenPrivilege 4600 Temprihanna.exe Token: SeMachineAccountPrivilege 4600 Temprihanna.exe Token: SeSecurityPrivilege 4600 Temprihanna.exe Token: SeAssignPrimaryTokenPrivilege 4600 Temprihanna.exe Token: SeCreateGlobalPrivilege 4600 Temprihanna.exe Token: 33 4600 Temprihanna.exe Token: SeDebugPrivilege 4808 explorer.exe Token: SeRestorePrivilege 4808 explorer.exe Token: SeBackupPrivilege 4808 explorer.exe Token: SeLoadDriverPrivilege 4808 explorer.exe Token: SeCreatePagefilePrivilege 4808 explorer.exe Token: SeShutdownPrivilege 4808 explorer.exe Token: SeTakeOwnershipPrivilege 4808 explorer.exe Token: SeChangeNotifyPrivilege 4808 explorer.exe Token: SeCreateTokenPrivilege 4808 explorer.exe Token: SeMachineAccountPrivilege 4808 explorer.exe Token: SeSecurityPrivilege 4808 explorer.exe Token: SeAssignPrimaryTokenPrivilege 4808 explorer.exe Token: SeCreateGlobalPrivilege 4808 explorer.exe Token: 33 4808 explorer.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3396 wrote to memory of 4600 3396 27721c21711b0a8f2ae1d1e1187cf7f61db114255c824d4f26609f291ef35f49.exe 83 PID 3396 wrote to memory of 4600 3396 27721c21711b0a8f2ae1d1e1187cf7f61db114255c824d4f26609f291ef35f49.exe 83 PID 3396 wrote to memory of 4600 3396 27721c21711b0a8f2ae1d1e1187cf7f61db114255c824d4f26609f291ef35f49.exe 83 PID 4600 wrote to memory of 4808 4600 Temprihanna.exe 84 PID 4600 wrote to memory of 4808 4600 Temprihanna.exe 84 PID 4600 wrote to memory of 4808 4600 Temprihanna.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\27721c21711b0a8f2ae1d1e1187cf7f61db114255c824d4f26609f291ef35f49.exe"C:\Users\Admin\AppData\Local\Temp\27721c21711b0a8f2ae1d1e1187cf7f61db114255c824d4f26609f291ef35f49.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temprihanna.exe"C:\Users\Admin\AppData\Local\Temprihanna.exe"2⤵
- Executes dropped EXE
- Sets file execution options in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Modifies firewall policy service
- Sets file execution options in registry
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4808 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 10724⤵
- Program crash
PID:2380
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4808 -ip 48081⤵PID:4172
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temprihanna.exe
- Size 197KB
- SHA256 a7094c7edfced8a28eee60330c270f8d9c5ab34d663aa565ac6591840a7b742a
- MD5 852c69a76a091643ee58ff2b038c540a
- SHA1 0f06f7191746fa1b788b25b63e907f0b5655c29a
- SHA512 d00f3166487ff1762a828fbdf3c20788999747efb23b72fb0d080d031d38929b6ea392af7342aac53c577f07dc1e17e1bdee40b7e3df845324275d6d3b316c8b
- SSDEEP 6144:3tB/0YcoDB+gCS6/ynwZ6eaw6gULn1zXjer4Tjp:3tt0FoDpCHb6eawbm17jbT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temprihanna.exe
- Size 197KB
- SHA256 a7094c7edfced8a28eee60330c270f8d9c5ab34d663aa565ac6591840a7b742a
- MD5 852c69a76a091643ee58ff2b038c540a
- SHA1 0f06f7191746fa1b788b25b63e907f0b5655c29a
- SHA512 d00f3166487ff1762a828fbdf3c20788999747efb23b72fb0d080d031d38929b6ea392af7342aac53c577f07dc1e17e1bdee40b7e3df845324275d6d3b316c8b
- SSDEEP 6144:3tB/0YcoDB+gCS6/ynwZ6eaw6gULn1zXjer4Tjp:3tt0FoDpCHb6eawbm17jbT
- MD5 SHA1 SHA512 SSDEEP