Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
24-07-2022 17:18
Behavioral task
behavioral1
Sample
d98edcaf8acdd135b38ad5d6ce503e59868555f5acb6aaa95017ec758a6603ac.exe
Resource
win7-20220715-en
windows7-x64
8 signatures
150 seconds
General
-
Target
d98edcaf8acdd135b38ad5d6ce503e59868555f5acb6aaa95017ec758a6603ac.exe
-
Size
233KB
-
MD5
a7608ce0baea081df610eb9accb4400e
-
SHA1
d86c816ed1b2dd0552587507d626cb34f8b5e0d6
-
SHA256
d98edcaf8acdd135b38ad5d6ce503e59868555f5acb6aaa95017ec758a6603ac
-
SHA512
8dacbce9b77c0becca3bdd682ac37982bf52bc9842ed4be2f0d2f9244b4915aef463ba51660879d28d0166ec0d2ced6d42e9b148fd2dcce4b9f31f85a3c3b7d7
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
policadam.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat policadam.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
policadam.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" policadam.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad policadam.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321097C-58FA-4DD6-B563-F9FA36548596}\WpadNetworkName = "Network 3" policadam.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-35-a4-69-4c-20\WpadDecision = "0" policadam.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings policadam.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections policadam.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" policadam.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 policadam.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321097C-58FA-4DD6-B563-F9FA36548596}\WpadDecision = "0" policadam.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-35-a4-69-4c-20 policadam.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-35-a4-69-4c-20\WpadDecisionTime = b00c1583819fd801 policadam.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 policadam.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings policadam.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00fe000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 policadam.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321097C-58FA-4DD6-B563-F9FA36548596} policadam.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321097C-58FA-4DD6-B563-F9FA36548596}\WpadDecisionTime = b00c1583819fd801 policadam.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix policadam.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" policadam.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321097C-58FA-4DD6-B563-F9FA36548596}\WpadDecisionReason = "1" policadam.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321097C-58FA-4DD6-B563-F9FA36548596}\a2-35-a4-69-4c-20 policadam.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\a2-35-a4-69-4c-20\WpadDecisionReason = "1" policadam.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
policadam.exepid process 1688 policadam.exe 1688 policadam.exe 1688 policadam.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
d98edcaf8acdd135b38ad5d6ce503e59868555f5acb6aaa95017ec758a6603ac.exepid process 1148 d98edcaf8acdd135b38ad5d6ce503e59868555f5acb6aaa95017ec758a6603ac.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
d98edcaf8acdd135b38ad5d6ce503e59868555f5acb6aaa95017ec758a6603ac.exed98edcaf8acdd135b38ad5d6ce503e59868555f5acb6aaa95017ec758a6603ac.exepolicadam.exepolicadam.exepid process 2004 d98edcaf8acdd135b38ad5d6ce503e59868555f5acb6aaa95017ec758a6603ac.exe 1148 d98edcaf8acdd135b38ad5d6ce503e59868555f5acb6aaa95017ec758a6603ac.exe 1656 policadam.exe 1688 policadam.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
d98edcaf8acdd135b38ad5d6ce503e59868555f5acb6aaa95017ec758a6603ac.exepolicadam.exedescription pid process target process PID 2004 wrote to memory of 1148 2004 d98edcaf8acdd135b38ad5d6ce503e59868555f5acb6aaa95017ec758a6603ac.exe d98edcaf8acdd135b38ad5d6ce503e59868555f5acb6aaa95017ec758a6603ac.exe PID 2004 wrote to memory of 1148 2004 d98edcaf8acdd135b38ad5d6ce503e59868555f5acb6aaa95017ec758a6603ac.exe d98edcaf8acdd135b38ad5d6ce503e59868555f5acb6aaa95017ec758a6603ac.exe PID 2004 wrote to memory of 1148 2004 d98edcaf8acdd135b38ad5d6ce503e59868555f5acb6aaa95017ec758a6603ac.exe d98edcaf8acdd135b38ad5d6ce503e59868555f5acb6aaa95017ec758a6603ac.exe PID 2004 wrote to memory of 1148 2004 d98edcaf8acdd135b38ad5d6ce503e59868555f5acb6aaa95017ec758a6603ac.exe d98edcaf8acdd135b38ad5d6ce503e59868555f5acb6aaa95017ec758a6603ac.exe PID 1656 wrote to memory of 1688 1656 policadam.exe policadam.exe PID 1656 wrote to memory of 1688 1656 policadam.exe policadam.exe PID 1656 wrote to memory of 1688 1656 policadam.exe policadam.exe PID 1656 wrote to memory of 1688 1656 policadam.exe policadam.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d98edcaf8acdd135b38ad5d6ce503e59868555f5acb6aaa95017ec758a6603ac.exe"C:\Users\Admin\AppData\Local\Temp\d98edcaf8acdd135b38ad5d6ce503e59868555f5acb6aaa95017ec758a6603ac.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d98edcaf8acdd135b38ad5d6ce503e59868555f5acb6aaa95017ec758a6603ac.exe--b389a7b62⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\policadam.exe"C:\Windows\SysWOW64\policadam.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\policadam.exe--438c9fac2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1148-54-0x0000000000000000-mapping.dmp
-
memory/1148-57-0x00000000002B0000-0x00000000002CB000-memory.dmpFilesize
108KB
-
memory/1148-58-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/1148-59-0x00000000765D1000-0x00000000765D3000-memory.dmpFilesize
8KB
-
memory/1148-61-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1688-60-0x0000000000000000-mapping.dmp
-
memory/1688-62-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/1688-64-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/2004-55-0x00000000001B0000-0x00000000001CB000-memory.dmpFilesize
108KB
-
memory/2004-56-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB