Analysis
-
max time kernel
126s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
16-06-2022 07:09
Static task
static1
Behavioral task
behavioral1
Sample
26d5725f7b9028b03df9cd6bbbb08fbbb78d909d5f8f3b6fe923285dce6a25b0.exe
Resource
win7-20220414-en
General
-
Target
26d5725f7b9028b03df9cd6bbbb08fbbb78d909d5f8f3b6fe923285dce6a25b0.exe
-
Size
176KB
-
MD5
38fdcd01a740f20a6ce85702ef490d0c
-
SHA1
ecb7f6563f75172ed8c8e1e57045418a6bee0481
-
SHA256
26d5725f7b9028b03df9cd6bbbb08fbbb78d909d5f8f3b6fe923285dce6a25b0
-
SHA512
b3debc0fe45a00332fb523767be212282a77b791f5bf07290116768614900750ef632401471984c658e994624b66a01fdac4bb5c7696bc7ee0190c35e42f9954
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
wscapihyper.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat wscapihyper.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
wscapihyper.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\46-b2-4c-05-48-fb\WpadDecisionTime = 507a9ca16e81d801 wscapihyper.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings wscapihyper.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections wscapihyper.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix wscapihyper.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" wscapihyper.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 wscapihyper.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8D91D596-DE99-47D5-B728-EF2B098C1211}\WpadNetworkName = "Network 3" wscapihyper.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\46-b2-4c-05-48-fb wscapihyper.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8D91D596-DE99-47D5-B728-EF2B098C1211}\46-b2-4c-05-48-fb wscapihyper.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 wscapihyper.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings wscapihyper.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8D91D596-DE99-47D5-B728-EF2B098C1211} wscapihyper.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8D91D596-DE99-47D5-B728-EF2B098C1211}\WpadDecisionReason = "1" wscapihyper.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8D91D596-DE99-47D5-B728-EF2B098C1211}\WpadDecisionTime = 507a9ca16e81d801 wscapihyper.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\46-b2-4c-05-48-fb\WpadDecisionReason = "1" wscapihyper.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad wscapihyper.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8D91D596-DE99-47D5-B728-EF2B098C1211}\WpadDecision = "0" wscapihyper.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" wscapihyper.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" wscapihyper.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f009d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 wscapihyper.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\46-b2-4c-05-48-fb\WpadDecision = "0" wscapihyper.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
26d5725f7b9028b03df9cd6bbbb08fbbb78d909d5f8f3b6fe923285dce6a25b0.exe26d5725f7b9028b03df9cd6bbbb08fbbb78d909d5f8f3b6fe923285dce6a25b0.exewscapihyper.exewscapihyper.exepid process 952 26d5725f7b9028b03df9cd6bbbb08fbbb78d909d5f8f3b6fe923285dce6a25b0.exe 1180 26d5725f7b9028b03df9cd6bbbb08fbbb78d909d5f8f3b6fe923285dce6a25b0.exe 1868 wscapihyper.exe 1152 wscapihyper.exe 1152 wscapihyper.exe 1152 wscapihyper.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
26d5725f7b9028b03df9cd6bbbb08fbbb78d909d5f8f3b6fe923285dce6a25b0.exepid process 1180 26d5725f7b9028b03df9cd6bbbb08fbbb78d909d5f8f3b6fe923285dce6a25b0.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
26d5725f7b9028b03df9cd6bbbb08fbbb78d909d5f8f3b6fe923285dce6a25b0.exewscapihyper.exedescription pid process target process PID 952 wrote to memory of 1180 952 26d5725f7b9028b03df9cd6bbbb08fbbb78d909d5f8f3b6fe923285dce6a25b0.exe 26d5725f7b9028b03df9cd6bbbb08fbbb78d909d5f8f3b6fe923285dce6a25b0.exe PID 952 wrote to memory of 1180 952 26d5725f7b9028b03df9cd6bbbb08fbbb78d909d5f8f3b6fe923285dce6a25b0.exe 26d5725f7b9028b03df9cd6bbbb08fbbb78d909d5f8f3b6fe923285dce6a25b0.exe PID 952 wrote to memory of 1180 952 26d5725f7b9028b03df9cd6bbbb08fbbb78d909d5f8f3b6fe923285dce6a25b0.exe 26d5725f7b9028b03df9cd6bbbb08fbbb78d909d5f8f3b6fe923285dce6a25b0.exe PID 952 wrote to memory of 1180 952 26d5725f7b9028b03df9cd6bbbb08fbbb78d909d5f8f3b6fe923285dce6a25b0.exe 26d5725f7b9028b03df9cd6bbbb08fbbb78d909d5f8f3b6fe923285dce6a25b0.exe PID 1868 wrote to memory of 1152 1868 wscapihyper.exe wscapihyper.exe PID 1868 wrote to memory of 1152 1868 wscapihyper.exe wscapihyper.exe PID 1868 wrote to memory of 1152 1868 wscapihyper.exe wscapihyper.exe PID 1868 wrote to memory of 1152 1868 wscapihyper.exe wscapihyper.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\26d5725f7b9028b03df9cd6bbbb08fbbb78d909d5f8f3b6fe923285dce6a25b0.exe"C:\Users\Admin\AppData\Local\Temp\26d5725f7b9028b03df9cd6bbbb08fbbb78d909d5f8f3b6fe923285dce6a25b0.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\26d5725f7b9028b03df9cd6bbbb08fbbb78d909d5f8f3b6fe923285dce6a25b0.exe"C:\Users\Admin\AppData\Local\Temp\26d5725f7b9028b03df9cd6bbbb08fbbb78d909d5f8f3b6fe923285dce6a25b0.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\wscapihyper.exe"C:\Windows\SysWOW64\wscapihyper.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscapihyper.exe"C:\Windows\SysWOW64\wscapihyper.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/952-55-0x0000000000290000-0x000000000029D000-memory.dmpFilesize
52KB
-
memory/952-59-0x0000000000290000-0x000000000029D000-memory.dmpFilesize
52KB
-
memory/952-54-0x00000000750C1000-0x00000000750C3000-memory.dmpFilesize
8KB
-
memory/952-68-0x00000000002A0000-0x00000000002B0000-memory.dmpFilesize
64KB
-
memory/952-67-0x0000000000280000-0x000000000028D000-memory.dmpFilesize
52KB
-
memory/1152-78-0x0000000000000000-mapping.dmp
-
memory/1152-89-0x0000000000360000-0x0000000000370000-memory.dmpFilesize
64KB
-
memory/1152-88-0x0000000000340000-0x000000000034D000-memory.dmpFilesize
52KB
-
memory/1152-84-0x0000000000350000-0x000000000035D000-memory.dmpFilesize
52KB
-
memory/1152-80-0x0000000000350000-0x000000000035D000-memory.dmpFilesize
52KB
-
memory/1180-66-0x0000000000280000-0x000000000028D000-memory.dmpFilesize
52KB
-
memory/1180-71-0x0000000000270000-0x000000000027D000-memory.dmpFilesize
52KB
-
memory/1180-70-0x0000000000290000-0x00000000002A0000-memory.dmpFilesize
64KB
-
memory/1180-69-0x0000000000270000-0x000000000027D000-memory.dmpFilesize
52KB
-
memory/1180-87-0x0000000000270000-0x000000000027D000-memory.dmpFilesize
52KB
-
memory/1180-62-0x0000000000280000-0x000000000028D000-memory.dmpFilesize
52KB
-
memory/1180-60-0x0000000000000000-mapping.dmp
-
memory/1868-73-0x0000000000340000-0x000000000034D000-memory.dmpFilesize
52KB
-
memory/1868-77-0x0000000000340000-0x000000000034D000-memory.dmpFilesize
52KB
-
memory/1868-85-0x0000000000330000-0x000000000033D000-memory.dmpFilesize
52KB
-
memory/1868-86-0x0000000000350000-0x0000000000360000-memory.dmpFilesize
64KB