Analysis
-
max time kernel
103s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01-07-2022 05:22
Static task
static1
Behavioral task
behavioral1
Sample
ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe
-
Size
2.4MB
-
MD5
3ec3a68292f489d7a88247eb10772564
-
SHA1
0069b5387c2731f94c95f8a727c606d1da633ab7
-
SHA256
ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e
-
SHA512
49530849e4ffa1f5e6103eac5633402af7e65f74babf943576db6925e1eb3fa34edf54f07e0fc55503e2044b5385167c6b143aecb4c03e8abfb91f7b1acd5d74
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1420-130-0x0000000000430000-0x0000000000BBA000-memory.dmp upx behavioral2/memory/1420-131-0x0000000000430000-0x0000000000BBA000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
Processes:
ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exedescription ioc process File created C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe = "11001" ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DOMStorage\adobe.com ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\adobe.com ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\adobe.com\NumberOfSubdomains = "1" ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "48" ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DOMStorage\auth.services.adobe.com ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\adobe.com\Total = "48" ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\auth.services.adobe.com\ = "48" ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exepid process 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
Processes:
ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exedescription pid process Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe Token: SeIncreaseQuotaPrivilege 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exepid process 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe 1420 ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe"C:\Users\Admin\AppData\Local\Temp\ebe8fb2c43dde2cd728ef1c2befe01e94be54bc91edcbcc831baf2471274543e.exe"1⤵
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx