Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
resource tags
arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system -
submitted
18-07-2022 14:19
Behavioral task
behavioral1
Sample
b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe
Resource
win7-20220414-en
windows7-x64
7 signatures
150 seconds
General
-
Target
b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe
-
Size
2.4MB
-
MD5
51939f450f807d9c5069dda3d654594b
-
SHA1
2b1cd36c08d8952d2807eb23751d8c566e978cfc
-
SHA256
b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e
-
SHA512
e009311ba2f88115d684445d9828af792ac8b7132c8de967d1ef4ffa6fc79609bbb6263973a6804314e2e3545ce700b073773ec84c40acc98d4a10b840f811bf
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3872-130-0x0000000000CB0000-0x000000000143A000-memory.dmp upx behavioral2/memory/3872-131-0x0000000000CB0000-0x000000000143A000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
Processes:
b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exedescription ioc process File created C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\adobe.com b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\adobe.com\NumberOfSubdomains = "1" b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DOMStorage\auth.services.adobe.com b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe = "11001" b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\adobe.com\Total = "48" b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DOMStorage\adobe.com b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "48" b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\auth.services.adobe.com\ = "48" b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exepid process 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
Processes:
b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exedescription pid process Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe Token: SeIncreaseQuotaPrivilege 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exepid process 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe 3872 b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe"C:\Users\Admin\AppData\Local\Temp\b6d88ea19d3ee9eccb9a254d0bc9263ec8336cc61abfdfc3ff8ade15abf2748e.exe"1⤵
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx